Privacy notice

1. Who is responsible

Each hospital or institution using the platform is the Data Fiduciary (under GDPR, the controller; under HIPAA, the covered entity) for the patient data it records. Sardhara Medical Private Limited acts as a Data Processor (under HIPAA, a business associate) and processes that data only on the institution's documented instructions, under the data processing agreement. The platform does not manage patients directly.

2. What we process and why

• Patient clinical data (identifiers, diagnoses, ECMO parameters, charts, medications, investigations, images, consents) — to deliver and document ECMO care. Lawful basis in India: consent of the patient or their representative, and medical treatment during an emergency (s.7(d) and s.7(f)).
• Staff account data (name, email, phone, role, sign-in and audit activity) — to provide secure access and a regulatory audit trail.
• Referral data shared by referring clinicians — to coordinate transfer and retrieval.

Data is never sold, used for advertising, or used to train AI models.

3. Children and persons with disability

For patients under 18 or lacking capacity, consent is taken from the parent or lawful guardian (s.9). No tracking, behavioural monitoring, or targeted advertising is performed.

4. Your rights as a data principal

• Obtain a summary of your personal data and processing (s.11)
• Request correction, completion, updating, or erasure (s.12)
• Withdraw consent, as easily as it was given (s.6(4))
• Nominate a person to exercise your rights (s.14)
• Have grievances redressed, and then approach the Data Protection Board of India (s.13)

Contact the Grievance Officer / Data Protection Officer of the hospital treating you. Each institution records requests in a register with response deadlines (30 days for rights requests, 90 days for grievances). Erasure may be deferred where medical-records law requires retention.

5. Storage, security, and retention

Data is encrypted at rest (AES-256) and in transit (TLS 1.2+), with strict per-institution isolation, role-based access, two-factor authentication, automatic idle sign-out, and an append-only audit trail. Controls follow ISO/IEC 27001:2022 Annex A. Records are retained as required by the medical-records law that applies to the institution, then erased or anonymised.

Where data is stored. The platform database is hosted by Neon (Amazon Web Services) in United States (US-East, Virginia). Transfer of personal data outside India is permitted under s.16 of the DPDP Act, and the same encryption, access controls and contractual safeguards apply wherever data is held. Institutions will be told in advance before data is moved to a different region, and the move is recorded in the audit trail.

Security and access logs are kept for at least 180 days, as required by the CERT-In Directions, 2022. Sensitive personal data, including medical records, is protected with reasonable security practices under s.43A of the Information Technology Act, 2000 and the SPDI Rules, 2011.

6. Breach notification

In the event of a personal data breach, the institution and Sardhara Medical Private Limited will inform affected individuals without delay and notify the relevant authority within the time the applicable law requires — in India, a detailed report to the Data Protection Board within 72 hours under the DPDP Rules, 2025, and a report to CERT-In within 6 hours of a reportable cyber incident being noticed. Deadlines for other regions are set out in sections 8 and 9.

7. Platform contact

Sardhara Medical Private Limited (CIN U32509GJ2026PTC184082), a company incorporated under the Companies Act, 2013, with its registered office at Tower-A, 4th Floor, Silver Square, B/s Patel Timber, Harni Colony, Vadodara 390022, Gujarat, India; in association with Janvi Multispeciality Hospital. For questions about the platform itself, contact your institution administrator, who can raise a support ticket with us.

Grievance Officer: Dr. Vishal Sardhara, Grievance Officer and Data Protection contact, Sardhara Medical Private Limited, Tower-A, 4th Floor, Silver Square, B/s Patel Timber, Harni Colony, Vadodara 390022, Gujarat, India. Email: grievance@ecmouniverse.com. Phone: +91 88660 59532. Complaints are acknowledged within 48 hours and resolved within 30 days. If you are not satisfied, you may approach the Data Protection Board of India. See also our contact page.

8. European Union and United Kingdom (GDPR)

For institutions established in the EU or EEA (EU GDPR, Regulation 2016/679) or in the United Kingdom (UK GDPR and the Data Protection Act 2018):

• Lawful basis. Health data is special-category data. It is processed to provide health care and manage health systems (Art. 6(1)(e) or (c), with Art. 9(2)(h)), to protect vital interests where a patient cannot consent (Art. 9(2)(c)), or with explicit consent where the institution relies on it (Art. 9(2)(a)).
• Your rights. Access (Art. 15), rectification (Art. 16), erasure where it applies (Art. 17), restriction (Art. 18), data portability (Art. 20), and objection (Art. 21). Requests are answered within one month, extendable by two further months for complex requests.
• Complaints. You may complain to the supervisory authority in your country — for example, the Information Commissioner's Office (ICO) in the UK.
• International transfers. Where data leaves the EU/EEA or UK, it is protected by Standard Contractual Clauses (or the UK International Data Transfer Addendum) in the data processing agreement, until the institution is moved to a regional database.
• Breaches. Sardhara Medical Private Limited informs the institution without undue delay; the institution notifies its supervisory authority within 72 hours and informs patients where the breach is likely to result in a high risk to them (Arts. 33–34).

9. United States (HIPAA)

For covered entities in the United States, patient clinical data is Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA) Privacy, Security, and Breach Notification Rules:

• Business Associate Agreement. A BAA is signed with each US institution before PHI is entered. PHI is used and disclosed only for treatment, payment, and health care operations, or as the institution directs, and only to the minimum necessary.
• Safeguards. The administrative, physical, and technical safeguards in section 5 — access control, unique user accounts, audit controls, integrity checks, and transmission security — are applied to all PHI.
• Patient rights. Patients exercise their rights to access, amend, and receive an accounting of disclosures of their PHI through the institution, which answers access requests within 30 days as the Privacy Rule requires.
• Breaches. Sardhara Medical Private Limited reports any breach of unsecured PHI to the institution without unreasonable delay and within the timeframe in the BAA. The institution notifies affected individuals within 60 days of discovery, and the HHS Office for Civil Rights and, where required, the media.

Each institution's own Notice of Privacy Practices remains the primary HIPAA notice to its patients.