NURTURE HOSPITAL

Entity Name: Ambuja Hospitals Private Limited
Corporate Identification Number: U85300KA2020PTC137262
Registration Number: 137262
Address: No. 80 (Old No. 36), 20th Main Road, 2nd Block, Rajajinagar, Bengaluru, Karnataka 560010
Email: info@nurturehospitals.in
Phone: 98800 09596

Effective Date: 02-10-2025
Last Revised: 02-10-2025

ARTICLE I – NOTICE OF PRIVACY PRACTICES

Section 1.1 – Legal Requirement: Indian healthcare regulations and international privacy standards require this Healthcare Privacy Notice. It describes how your protected health information (PHI) may be used and disclosed, as well as how you can access this information.

Section 1.2 – Our Commitment Nurture Hospital is committed to protecting the privacy and confidentiality of your health information. We are required by law to maintain the privacy of your health information and to provide you with this notice of our legal duties and privacy practices.

Section 1.3 – Scope of Protected Information This notice applies to all protected health information maintained by Nurture Hospital, including:

• Medical records and treatment history
• Billing and payment information
• Insurance and coverage details
• Diagnostic test results and medical imaging
• Prescription and medication records
• Appointment and scheduling information

ARTICLE II – DEFINITION OF PROTECTED HEALTH INFORMATION

Section 2.1 – Health Information Categories Protected Health Information (PHI) includes individually identifiable health information that: (a) Demographic Information: Name, address, birth date, contact details (b) Medical Information: Diagnoses, treatments, procedures, test results (c) Payment Information: Insurance details, billing records, financial data (d) Healthcare Operations: Quality assessments, professional training data

Section 2.2 – Information Sources PHI is collected from various sources, including:

• Patient-provided information during registration and consultations
• Healthcare providers involved in patient care
• Insurance companies and third-party payers
• Laboratory and diagnostic service providers
• Previous healthcare providers and medical facilities

Section 2.3 – Electronic Health Records All PHI is maintained in secure electronic health record systems with appropriate access controls, encryption, and audit trails to ensure confidentiality and integrity.

ARTICLE III – PERMITTED USES AND DISCLOSURES WITHOUT AUTHORIZATION

Section 3.1 – Treatment Purposes We may use and disclose your PHI for treatment purposes, including: (a) Providing direct medical care and services, (b) Coordinating care among healthcare providers (c) Consulting with specialists and other medical professionals, (d) Referring you to other healthcare providers (e) Emergency treatment situations (f) Continuing care coordination after discharge

Example: We may share your medical history with a consulting gynecologist to ensure comprehensive care during pregnancy.

Section 3.2 – Payment Activities We may use and disclose your PHI for payment purposes, including: (a) Processing insurance claims and prior authorizations, (b) Billing for services rendered, (c) Collecting payment for healthcare service,s (d) Determining insurance coverage and benefits (e) Medical necessity reviews by insurance companies (f) Healthcare fraud and abuse detection programs

Example: We may disclose treatment information to your insurance company to process claims for maternity services.

Section 3.3 – Healthcare Operations We may use and disclose your PHI for healthcare operations, including: (a) Quality assessment and improvement activities, (b) Medical staff credentialing and peer review, (c) Medical education and training program,s (d) Accreditation and certification activitiess (e) Legal and regulatory compliance activities, (f) Business planning and facility management

Example: We may review medical records for quality improvement purposes to enhance our maternity care programs.

ARTICLE IV – OTHER PERMITTED DISCLOSURES

Section 4.1 – Public Health Activities We may disclose PHI for public health purposes to: (a) Public health authorities for disease prevention and control (b) Government agencies for health oversight activities (c) Medical authorities for communicable disease reporting (d) Child protective services when required by law (e) Workplace medical surveillance programs (f) Product safety and effectiveness monitoring

Section 4.2 – Legal Requirements We may disclose PHI when required by law for: (a) Court orders and judicial proceeding,s (b) Law enforcement investigations and activiti, es (c) Regulatory agency inspections and investigati,ons (d) Workers’ compensation claims proces, sing (e) Coroner and medical examiner investigations, (f) Organ and tissue donation organizations

Section 4.3 – Emergency Situations We may disclose PHI in emergencies: (a) To prevent or lessen a serious threat to health or safety, (b) For disaster relief and emergency response (c) To notify family members of patient’s condition, (d) For emergency treatment by other providers (e) When patient is unable to provide consent due toa  medical condition

Section 4.4 – Specialized Government Functions Limited PHI disclosure for: (a) Military and veterans affairs activities, (b) National security and intelligence activities, (c) Correctional institutions and law enforcement custody, (d) Government benefit programs eligibility determination

ARTICLE V – USES AND DISCLOSURES REQUIRING AUTHORIZATION

Section 5.1 – Written Authorization Required Your written authorization is required for: (a) Marketing communications and promotional materials (b) Sale of PHI to third parties (prohibited except in limited circumstances) (c) Most uses and disclosures of psychotherapy notes (d) Research studies not covered by institutional review board approval (e) Disclosure to employers (except for workplace injury treatment) (f) Release of information to family members (except in emergencies)

Section 5.2 – Authorization Process Valid authorizations must include:

• Specific information to be disclosed
• Purpose of the disclosure
• Identity of persons authorized to receive information
• Expiration date or event
• Patient signature and date
• Right to revoke authorization

Section 5.3 – Revocation Rights You may revoke any authorization at any time by providing written notice to our Privacy Officer. Revocation will not affect disclosures already made based on your previous authorization.

ARTICLE VI – PATIENT RIGHTS REGARDING PHI

Section 6.1 – Right to Access Medical Records You have the right to: (a) Inspect and obtain copies of your medical records, (b) Request medical records in electronic format when available, (c) Designate third parties to receive copies of medical records, (d) Request delivery of copies to specific locations

Limitations: We may deny access to certain information, including psychotherapy notes, information compiled for legal proceedings, or information that may endanger you or others.

Section 6.2 – Right to Request Amendment You have the right to request amendments to your medical records if you believe information is incorrect or incomplete. We may deny requests if:

• Information was not created by our facility
• Information is accurate and complete as recorded
• Information is not part of the records available for inspection

Section 6.3 – Right to Request Restrictions You may request restrictions on how we use or disclose your PHI for: (a) Treatment, payment, or healthcare operations, (b) Disclosures to family members or friends, (c) Communications about your care or condition

We are not required to agree to restrictions, except:

• Disclosures to health plans when you pay out-of-pocket in full
• Other restrictions required by law

Section 6.4 – Right to Confidential Communications You may request that we communicate with you about medical matters: (a) At alternative locations (home, work, etc.) (b) Through alternative methods (phone, email, mail) (c) At specific times or frequencies (d) Through designated individuals only

Section 6.5 – Right to Accounting of Disclosures You may request an accounting of PHI disclosures made by our facility for purposes other than treatment, payment, or healthcare operations during the previous six years.

Section 6.6 – Right to Paper Copy of Privacy Notice You have the right to receive a paper copy of this Privacy Notice upon request, even if you previously agreed to receive it electronically.

ARTICLE VII – NOTIFICATION OF BREACH

Section 7.1 – Breach Notification Policy If a breach of your PHI occurs, we will notify you in accordance with applicable law requirements, including: (a) Written notification within 60 days of discovery (b) Description of the breach and information involved (c) Steps you should take to protect yourself (d) Actions we are taking to investigate and prevent future breaches.

Section 7.2 – Breach Prevention Measures We implement comprehensive safeguards, including:

• Regular security risk assessments
• Employee training on privacy and security
• Physical and technical access controls
• Incident response and reporting procedures
• Business associate agreements with third parties

ARTICLE VIII – SPECIAL PROTECTIONS FOR SENSITIVE INFORMATION

Section 8.1 – Mental Health Information Mental health and psychiatric information receives enhanced protection and may require separate authorization for disclosure beyond treatment, payment, and healthcare operations.

Section 8.2 – Substance Abuse Treatment Information related to substance abuse diagnosis and treatment is subject to federal confidentiality regulations and requires specific authorization for most disclosures.

Section 8.3 – Genetic Information Genetic information and genetic test results receive special protection and are subject to additional restrictions on use and disclosure.

Section 8.4 – HIV/AIDS Information HIV testing results and AIDS-related information are subject to specific state confidentiality laws and enhanced protection measures.

Section 8.5 – Reproductive Health Services Information related to reproductive health services, including family planning and fertility treatments, receives enhanced confidentiality protection.

ARTICLE IX – MINIMUM NECESSARY STANDARD

Section 9.1 – General Principle We limit the use and disclosure of PHI to the minimum amount necessary to accomplish the intended purpose, except for:

• Disclosures to healthcare providers for treatment
• Disclosures to patients about their own information
• Uses and disclosures authorized by the patient
• Disclosures required by law

Section 9.2 – Implementation Methods We implement minimum necessary standards through: (a) Role-based access controls in electronic systems, (b) Standard data sets for routine disclosure, (c) Case-by-case review for non-routine disclosure, (d) Regular training for workforce members

ARTICLE X – BUSINESS ASSOCIATES AND THIRD PARTIES

Section 10.1 – Business Associate Relationships We may share PHI with business associates who perform services on our behalf, including:

• Medical transcription services
• Billing and collection agencies
• Information technology service providers
• Legal and accounting services
• Laboratory and imaging services
• Insurance claim processing companies

Section 10.2 – Business Associate Agreements All business associates must sign agreements requiring them to: (a) Protect PHI in accordance with privacy regulations, (b) Use PHI only for specified purposes, (c) Implement appropriate safeguards, (d) Report any breaches or security incidents, (e) Return or destroy PHI when services end

Section 10.3 – International Data Transfers Any transfer of PHI outside India is conducted with appropriate safeguards and in compliance with applicable international data protection laws.

ARTICLE XI – PATIENT RESPONSIBILITIES

Section 11.1 – Information Accuracy Patients are responsible for: (a) Providing accurate and complete health information, (b) Updating demographic and contact information, (c) Informing us of changes in insurance coverage,(d) Correcting any inaccuracies in their medical records

Section 11.2 – Authorization Management Patients should:

• Carefully review authorization forms before signing
• Keep copies of all signed authorizations
• Notify us if they wish to revoke any authorization
• Understand the implications of authorizing disclosures

ARTICLE XII – COMPLAINTS AND GRIEVANCES

Section 12.1 – Internal Complaint Process If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer. Complaints must be:

• Submitted in writing
• Filed within 180 days of the incident
• Include specific details about the privacy violation
• Provide contact information for follow-up

Section 12.2 – External Complaint Options You may also file complaints with:

• State medical board or health department
• Regional data protection authority
• Relevant professional licensing boards
• Healthcare accreditation organizations

Section 12.3 – No Retaliation Policy We will not retaliate against you for:

• Filing a privacy complaint
• Exercising your privacy rights
• Providing information for privacy investigations
• Opposing practices you believe violate privacy rights

ARTICLE XIII – CHANGES TO PRIVACY PRACTICES

Section 13.1 – Modification Authority We reserve the right to modify our privacy practices and make the new provisions effective for all PHI we maintain, including information created or received before the change.

Section 13.2 – Notice of Changes If we make material changes to our privacy practices, we will: (a) Post the revised notice on our website, (b) Provide written notice to affected patients.,

s (c) Make the revised notice available upon request (d) Update the effective date of the privacy notice

Section 13.3 – Current Notice Availability The current version of our privacy notice is always available:

• On our website at [website URL]
• At patient registration areas
• Upon request from our Privacy Officer
• In patient admission packets

ARTICLE XIV – CONTACT INFORMATION FOR PRIVACY MATTERS

Privacy Officer
Nurture Hospital
Ambuja Hospitals Private Limited
No. 80 (Old No. 36), 20th Main Road, 2nd Block, Rajajinagar
Bengaluru, Karnataka 560010, India

Contact Methods:
Primary Email: info@nurturehospitals.in
Phone: 98800 09596
Fax: [Insert fax number if available]

Office Hours: Monday through Saturday, 9:00 AM to 6:00 PM
Emergency Privacy Concerns: Contact the main hospital number for after-hours privacy emergencies

Mailing Address for Written Complaints:
Privacy Officer
[Same address as above]
Subject Line: “PRIVACY COMPLAINT – CONFIDENTIAL”

ARTICLE XV – EFFECTIVE DATE AND ACKNOWLEDGMENT

Section 15.1 – Effective Date This Healthcare Privacy Notice is effective as of the date listed at the top of this document and remains in effect until replaced or updated.

Section 15.2 – Patient Acknowledgment We will request that you acknowledge receipt of this Privacy Notice. However, treatment will not be conditioned on your acknowledgment, except in limited circumstances where the acknowledgment is required by law.

Section 15.3 – Electronic Health Record Consent By receiving treatment at our facility, you consent to the maintenance of your health information in electronic format and the use of electronic systems for treatment, payment, and healthcare operations.

ACKNOWLEDGMENT FORM

Patient Information: Patient Name: _________________________________
Date of Birth: ________________________________
Medical Record Number: _______________________

Acknowledgment Statement: I acknowledge that I have received a copy of Nurture Hospital’s Healthcare Privacy Notice. I understand that this notice describes how my health information may be used and disclosed, and how I can access this information. I understand that I have rights regarding my health information and how it is used and disclosed.

Patient Signature: _________________________________ Date: _____________

If signed by representative: Representative Name: _________________________________
Relationship to Patient: ______________________________
Representative Signature: _____________________________ Date: _____________

For Hospital Use Only: □ Patient acknowledged receipt.
□ Patient refused to acknowledge (reason): ________________
□ Acknowledgment not obtained (reason): _________________

Staff Signature: _____________________________________ Date: _____________

Document Control:

• Version: 1.0
• Language: English
• Jurisdiction: Karnataka, India
• Classification: Public Document
• Review Schedule: Annual or as required by regulatory changes

This Healthcare Privacy Notice complies with applicable Indian healthcare privacy regulations and international standards for protected health information. For questions about specific privacy rights or legal requirements, consult qualified legal counsel.