Lavender Lane is a brand of Heart and Soul Medical Advisors Private Limited. This policy applies to our Noida centre, to any additional Lavender Lane centre from the date it opens, and to lavenderlanechildcare.com.
Lavender Lane is a paediatric care centre operated by Heart and Soul Medical Advisors Private Limited ("we", "us", "our"). For purposes of applicable data-protection law, including the Digital Personal Data Protection Act, 2023 (the "DPDP Act") where applicable, Heart and Soul Medical Advisors Private Limited is responsible for deciding why and how personal data is processed.
This policy applies when you enquire about our services, register your child as a patient, receive care from us, subscribe to The Lavender Circle or use the Digital Health Record, contact us by telephone, email or WhatsApp, visit our premises, or use our website. Read it together with the consent form, registration form, clinical documentation or membership terms that apply to the relevant service.
This policy does not govern third parties that independently determine how they use personal data, such as an insurer or a hospital to which we refer you. Those organisations may have their own privacy notices.
Please give us only information relevant to your request or your child's care. If you provide personal data about another person, you should be authorised to do so.
We use personal data only for purposes connected with operating Lavender Lane, providing requested healthcare and services, and meeting our legal and professional responsibilities. These purposes include:
We do not sell, rent or trade personal data. We do not use a child's health data for targeted advertising.
Our clinical services are designed for children. Where applicable law requires verifiable consent from a parent or lawful guardian before processing a child's personal data, we obtain that consent before the relevant processing.
We do not assume that an adult is entitled to act for a child. Where verifiable parental or guardian consent is required, we take reasonable steps to confirm that the person giving consent is an identifiable adult and is the parent or lawful guardian, using reliable information already available to us or information voluntarily provided for that purpose. We record the consent and the method by which it was obtained to the extent required for accountability and legal compliance.
Where applicable law permits a clinical establishment or healthcare professional to process a child's data without the ordinary consent formalities to provide health services necessary to protect the child's health, we rely on that exception only to the extent permitted by law. For optional services outside necessary clinical care, we obtain the consent required by applicable law.
We do not use children's personal data for behavioural monitoring or targeted advertising except to the extent expressly permitted by applicable law. We do not publish a child's name, photograph, medical story or membership details for promotional purposes without separate, specific permission from a parent or lawful guardian.
Adolescent patients may sometimes share information with a clinician that they have not shared with a parent. We handle such conversations using clinical judgement and in accordance with applicable law, safeguarding obligations and professional standards, and explain any limits on confidentiality where appropriate.
When a patient turns eighteen, the handling of access to and rights over their record will transition to the adult patient, subject to identity verification, applicable law and any continuing lawful authority held by another person.
The Lavender Circle may include a Digital Health Record that brings together information such as your child's vaccinations, prescriptions, growth charts and reports and makes it accessible through supported communication channels, including WhatsApp. Because WhatsApp is a third-party platform that we do not control, the following is important:
References in our membership material to a Digital Health Record being available "for life" describe our service commitment to continued access and do not override your privacy rights or our legal and professional record-retention obligations.
We share personal data only where reasonably necessary for the purposes described in this policy and with appropriate safeguards. Recipients may include:
Where a service provider processes personal data on our behalf, we use contractual and organisational safeguards appropriate to the nature of the service and the sensitivity of the data. We may provide information about material categories of service providers on request, subject to security and confidentiality considerations.
Some service providers used for communications, cloud services, email, support or other functions may process or store personal data outside India. Where personal data is transferred outside India, we do so in accordance with applicable data-protection law and any country, territory or transfer restrictions notified by the Central Government. We also seek appropriate contractual, technical and organisational safeguards having regard to the nature and sensitivity of the data.
We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, for the minimum period required by applicable medical, legal, tax, accounting or regulatory obligations, or for longer where reasonably needed to establish, exercise or defend legal claims. Our current retention framework is:
| Category | Typical retention period |
|---|---|
| Medical and clinical records, including day-care, procedure and teleconsultation records, prescriptions and reports | At least the period required by applicable medical and professional rules. Where the applicable rule requires it, indoor-patient records are retained for not less than 3 years from commencement of treatment. Records may be kept longer where clinically, legally or operationally appropriate. |
| Enquiries where the child does not become a patient | 12 months, unless a longer period is reasonably needed for a complaint, legal claim or other lawful purpose |
| Membership, billing, tax and accounting records | 8 years from the end of the relevant financial year, or such other period as applicable law requires |
| Insurance and claim correspondence | 3 years from closure of the claim, or longer where required for an open dispute or legal obligation |
| Consent and permission records | For as long as needed to demonstrate the relevant consent or permission and for an appropriate period thereafter |
| CCTV footage | Normally up to 30 days, unless preserved for a safety, security, complaint or legal incident |
| Call recordings | Normally up to 90 days, unless incorporated into a clinical, complaint, training, security or legal record |
| Website analytics data | According to the settings of the relevant analytics service and our business need, and anonymised or deleted when no longer required |
| Security and access logs | Normally up to 1 year, unless a longer period is required for investigation, security or legal purposes |
| Marketing preferences and opt-outs | Until you change or withdraw the preference, plus a limited record needed to honour the opt-out |
When a retention period ends and no legal or other lawful basis requires continued retention, we securely delete or irreversibly anonymise the data, and where appropriate require relevant processors to do the same.
We use reasonable technical and organisational safeguards proportionate to the sensitivity of paediatric health data and the risks involved. Depending on the system and service, these measures may include access controls, individual user authentication, encryption or other transmission and storage protections, audit and security logging, secure hosting, patching, backups and restoration procedures, confidentiality obligations, staff training, physical security and periodic review of service providers and controls.
No method of transmission or storage is completely secure. If a personal data breach occurs, we will take reasonable steps to contain, investigate and remedy it. We will notify affected individuals and competent authorities, including the Data Protection Board of India and/or CERT-In where applicable, within the manner and timelines required by the law then in force. Any notification to affected individuals will, where required, explain the nature of the breach, likely consequences, mitigation steps and how to contact us.
Subject to applicable law, you may have the right to:
To exercise a privacy right, contact us using section 12. We may verify your identity and your relationship or authority in relation to the child before disclosing health information or acting on a request. We aim to acknowledge general privacy requests within 7 days and respond within the period required by applicable law. Where an applicable medical-professional rule requires requested medical records to be issued within 72 hours to the patient, an authorised attendant or legal authority, we will follow that shorter requirement. Any fee for copies will be charged only where permitted by applicable law or professional rules.
You may withdraw consent as easily as you gave it. Once a valid withdrawal is received, we will stop processing that depends solely on the withdrawn consent as soon as reasonably practicable and as required by applicable law, and will instruct relevant processors accordingly. Withdrawal does not affect processing already carried out lawfully, and it does not require us to delete records that we must or may lawfully retain. Withdrawing consent for an optional service may mean that we can no longer provide that service, but it will not by itself prevent your child from receiving clinically necessary care that can lawfully be provided on another basis.
Cookies and similar technologies. We may use strictly necessary cookies or similar technologies to operate and secure the website. If we use analytics, preference or other non-essential technologies for which consent is required, we will provide an appropriate choice before setting them and a reasonable way to change that choice. You can also manage cookies through your browser settings. We do not knowingly use children's personal data for targeted advertising.
CCTV. CCTV may operate in appropriate areas of our premises for patient, visitor and staff safety and security. Where CCTV is installed, appropriate signage is displayed. Cameras are not installed in toilets, changing areas or other areas where a person would reasonably expect a high degree of privacy. Access to footage is restricted and footage is disclosed only where reasonably necessary or required or permitted by law.
Call recording. Where we record a call, we will inform you at or around the start of the call or through another appropriate notice. Recordings may be used for care coordination, quality, training, complaint handling or security. Where operationally feasible, an alternative such as a written note may be available if you do not wish a non-essential call to be recorded.
Photography and testimonials. We do not use a child's image, name, story or a parent's testimonial for promotional purposes without separate, specific permission stating the intended use. Permission may be withdrawn for future uses, and we will remove material from channels we control where reasonably practicable, although we may not be able to recall material already printed or independently re-shared by others. Clinical photography taken for a medical purpose is handled as part of the clinical record and subject to applicable consent and professional requirements.
We may update this policy from time to time. We will post the updated version with a new version number and date. If a change materially affects processing that depends on your consent, we will seek fresh consent where required by applicable law. We will not treat continued use of our services as consent to a materially different use of personal data where the law requires affirmative consent.