PRIVACY POLICY

Sterling Hospitals

This policy shall be applicable with effect from 01st November 2026

1. Introduction

Sterling Hospitals, a unit of Sterling Addlife India Private Limited a company incorporated under the provisions of Companies Act, 1956 having CIN U85110GJ2000PTC039121 and having its registered office at Sterling Addlife India Private Limited, Office No. 311,312,313, ISCON Mall, Satellite Road, Satellite, Ahmedabad - 380015, Gujarat, India, Gujarat, which owns and operates the hospitals, clinics, and digital platforms under the brand "Sterling Hospitals" (together with its affiliates and subsidiaries, "Sterling", "we", "us", or "our"), is committed to protecting the privacy, confidentiality, and integrity of the personal data entrusted to us.

We recognise that when you visit our hospitals, use our website https://www.sterlinghospitals.com; our mobile application; patient portals; teleconsultation services; or otherwise interact with us, and you place your trust in us. This Privacy Policy "Policy" explains what personal data we collect, why we collect it, how we use, share, store, and protect it, and the rights available to you under applicable Indian law, including the Digital Personal Data Protection Act, 2023 "DPDP Act", and the Digital Personal Data Protection Rules, 2025 "DPDP Rules", and the Information Technology Act, 2000 and the rules made thereunder, and applicable healthcare laws and regulations as applicable from time to time.

By accessing our website or services, or by providing your personal data to us, you acknowledge that you have read and understood this Policy. Where processing is based on your consent, we will seek that consent separately in a clear and specific manner.

2. Scope

This Policy applies to personal data collected, physically or digitally, from:

• Patients availing consultation, diagnostic, treatment, emergency, daycare, or inpatient services at any Sterling facility;
• Attendants, caregivers, guardians, nominees, family members, and legal representatives of patients;
• Visitors to our premises, including persons captured on CCTV surveillance;
• Users of our website, mobile applications, patient portals, appointment-booking tools, chatbots, and teleconsultation platforms;
• Persons who submit enquiries, make payments, provide feedback, participate in surveys, health camps, or awareness programmes; and
• Job applicants, doctors and healthcare professionals seeking empanelment, vendors, and business partners (to the extent their personal data is processed).

This Policy does not apply to third-party websites, applications, or services that may be linked from our platforms, or to entities that Sterling does not own or control (such as independent laboratories, insurers, or third-party administrators), except where they process data on our behalf under a contract with us. Employees of Sterling are additionally governed by our internal employee privacy notice.

3. Definitions

In this Policy, unless the context otherwise requires:

• "Personal Data" means any data about an individual who is identifiable by or in relation to such data, including name, contact details, identification details, health records, and financial details.
• "Health Data" means personal data relating to your physical, physiological, or mental health condition, medical history and records, diagnosis, treatment, test and scan results, prescriptions, and related information.
• "Data Principal" or "you" means the individual to whom the personal data relates and, in the case of a child or a person with disability, includes their parent or lawful guardian.
• "Data Fiduciary" means Sterling, which determines the purpose and means of processing your personal data.
• "Data Processor" means any third party that processes personal data on behalf of Sterling under a contract, such as IT and cloud service providers, payment gateways, and diagnostic laboratories.
• "Child" means an individual who has not completed eighteen (18) years of age.
• "Processing" means any operation performed on personal data, including collection, recording, storage, use, sharing, disclosure, and erasure.

4. Personal Data We Collect

Depending on your relationship with us, we may collect the following categories of personal data. The examples below are illustrative and not exhaustive.

We collect only such personal data as is necessary for the purposes described in this Policy. You may choose not to provide certain information; however, this may affect our ability to provide some services to you.

5. How We Collect Personal Data

• Directly from you - when you register as a patient, fill admission or consent forms, book appointments, speak to our doctors, nurses, or staff, make payments, or submit feedback.
• Through our digital platforms - when you use our website, mobile application, patient portal, chatbot, or teleconsultation services.
• From third parties - from referring doctors and hospitals, insurers and TPAs, corporate clients, government health schemes, diagnostic partners, the Ayushman Bharat Digital Mission (ABDM) network with your consent, and persons who provide information on your behalf (such as family members in an emergency).
• At events and programmes - health camps, workshops, community outreach, and awareness campaigns.
• Automatically - through cookies, analytics tools, server logs, and CCTV surveillance systems at our premises.

6. Lawful Basis: Consent and Legitimate Uses

We process your personal data on the following grounds:

• Consent - where you have given free, specific, informed, unconditional, and unambiguous consent through a clear affirmative action (for example, by signing a consent form or ticking an opt-in box). Each request for consent will be accompanied by a notice describing the personal data and the purposes of processing.
• Legitimate uses permitted by law - without separate consent where permitted under Section 7 of the DPDP Act, including: to respond to a medical emergency involving a threat to your life or health; to provide medical treatment or health services during an epidemic, outbreak, or other threat to public health; to take measures for safety during a disaster or breakdown of public order; to comply with any law, judgment, or order; and for purposes for which you have voluntarily provided your personal data and have not indicated that you do not consent to its use.

Withdrawal of consent

You may withdraw your consent at any time, with the same ease with which it was given, by writing to us at dpo@sterlinghospitals.com or through the mechanism provided on our website or app. Withdrawal will not affect the lawfulness of processing carried out before withdrawal, nor processing that we are required or permitted to continue under law (for example, maintaining medical records). Where withdrawal prevents us from carrying out a particular purpose, we will inform you of the consequences.

7. Purposes for Which We Use Personal Data

We will not use your personal data for purposes that are incompatible with those described above without informing you and, where required, obtaining your consent.

8. Children and Persons with Disability

Where the Data Principal is a child or a person with disability who has a lawful guardian, we will process their personal data with the verifiable consent of the parent or lawful guardian, except where processing is permitted without such consent under the DPDP Act and DPDP Rules (for example, for the provision of health services by a clinical establishment or healthcare professional, to the extent necessary to protect the health of the child). We do not undertake tracking, behavioural monitoring, or targeted advertising directed at children.

If you provide personal data about a child, a person with disability, or any other individual (such as a family member or nominee), you confirm that you are authorised to do so and that such individual (or their guardian) has been informed of this Policy.

9. Sharing and Disclosure of Personal Data

We do not sell or rent your personal data. We share personal data only to the extent necessary, with appropriate contractual and security safeguards, in the following circumstances:

• Healthcare providers: treating and referring doctors, specialists, visiting consultants, laboratories, blood banks, and other healthcare professionals involved in your care.
• Service providers (Data Processors): IT, hospital information system, cloud hosting, payment gateway, banking, communication (SMS/WhatsApp/email), call-centre, logistics, survey, and marketing service providers, who process data only on our instructions and are bound by confidentiality obligations.
• Insurers and payers: insurance companies, TPAs, corporate clients, and government health schemes, to process your claims or coverage, as authorised by you.
• Government and regulatory authorities: health authorities, the National Health Authority, courts, tribunals, law-enforcement agencies, and other bodies where disclosure is required by law, a court order, or for public health purposes.
• Professional advisors: auditors, legal advisors, accreditation bodies, and consultants under obligations of confidentiality.
• In emergencies: ambulance services, emergency responders, other hospitals, and family members or emergency contacts, where necessary to protect your life or health.
• Corporate transactions: in the event of a merger, acquisition, restructuring, or sale of assets, personal data may be transferred to the successor entity, subject to equivalent data protection safeguards.
• Group entities: Sterling affiliates and subsidiaries for the purposes described in this Policy.

We may share aggregated or anonymised data that does not identify any individual for research, statistical, and service-improvement purposes.

10. Cookies and Similar Technologies

Our website and apps use cookies and similar technologies (such as pixel tags and analytics scripts) to enable essential functions, remember your preferences, keep sessions secure, understand how our platforms are used, and measure the effectiveness of our communications. We categorise cookies as:

• Strictly necessary - required for the website to function (e.g. session management, security). These cannot be switched off.
• Analytics and performance - help us understand how visitors use our website so that we can improve it.
• Marketing - used, only with your consent, to deliver relevant information about our services and measure campaign effectiveness.

You can manage your cookie preferences through our cookie banner or your browser settings. Blocking certain cookies may affect the functionality of our website. We do not store sensitive health information in cookies.

11. Communications and Marketing

We will send you service-related communications (such as appointment reminders, reports, and billing information, etc.) as necessary to provide our services. We will send promotional communications about health packages, camps, offers, and events only where you have opted in, that is, where you have given your specific consent to receive such communications, for example by ticking the marketing opt-in box on our patient registration, admission or discharge form, or on our website or app. Your opt-in is recorded in our systems, and we do not send promotional communications to anyone who has not opted in. You may opt out of promotional communications at any time by using the unsubscribe link in our emails, using the opt-out option provided in our SMS or WhatsApp messages, or writing to [Email - dpo@sterlinghospitals.com]. Opting out of marketing will not affect service-related communications.

12. Data Security

We implement reasonable security safeguards to protect personal data against unauthorised access, use, alteration, disclosure, loss, or destruction, including:

• Encryption of data in transit (SSL/TLS) and, where appropriate, at rest; masking and tokenisation of sensitive identifiers;
• Role-based access controls on a need-to-know basis, multi-factor authentication, and access logs;
• Network security controls, firewalls, anti-malware, backup, and business continuity measures;
• Physical security of our premises, records rooms, and IT infrastructure;
• Confidentiality obligations and periodic privacy and security training for staff; and
• Contractual security obligations and due diligence for Data Processors, and periodic security assessments and audits.

We retain relevant logs for at least one year, or longer where required by law, for the detection and investigation of security incidents. While we take all reasonable steps to protect your personal data, no method of transmission over the internet or of electronic storage is completely secure.

13. Personal Data Breach

In the event of a personal data breach, we will take prompt steps to contain and remediate it. We will inform affected individuals without delay, describing the nature of the breach, its likely consequences, the measures we are taking, and steps you can take to protect yourself, and will notify the Data Protection Board of India and other authorities (such as CERT-In) within the timelines prescribed by law.

14. Retention of Personal Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required under applicable law. In particular:

• Medical records are retained for the period prescribed under applicable medical, clinical establishment, and regulatory requirements Minimum 4 years for in-patient records, 3 years for Out-patient record, MLC, Birth & Death, Litigation and Potential Litigation for life long and in any event for as long as necessary for continuity of care and the establishment or defence of legal claims.
• Financial and billing records are retained as required under tax and accounting laws.
• CCTV footage is retained for 45 days, unless required for an investigation or legal proceedings.
• Marketing data is retained only for as long as necessary for the purpose for which it was collected, or until you withdraw your consent, whichever is earlier, subject to applicable legal requirements.
• Job applicant data is retained for 5 years after the recruitment process concludes.

When personal data is no longer required, we will securely erase it or anonymise it so that it can no longer identify you, after giving prior notice where required by law.

15. Your Rights

Subject to applicable law, you have the following rights in relation to your personal data:

• Right to information and access - to obtain a summary of your personal data processed by us, the processing activities undertaken, and the identities of other Data Fiduciaries and Data Processors with whom it has been shared. Copies of medical records may be obtained as per our medical records release procedure.
• Right to correction, completion, and updating - to correct inaccurate or misleading personal data, complete incomplete data, and update your data.
• Right to erasure - to request erasure of personal data that is no longer necessary for the purpose for which it was processed, unless retention is required by law (such as medical records).
• Right to withdraw consent - as described in Section 6.
• Right to nominate - to nominate another individual to exercise your rights in the event of your death or incapacity.
• Right to grievance redressal - to raise a grievance with us regarding the processing of your personal data, and thereafter to approach the Data Protection Board of India.

To exercise these rights, please write to our Data Protection Officer at the details in Section 20. We may need to verify your identity (and, where applicable, your authority to act on behalf of another person) before acting on your request. We will respond within the timelines prescribed under applicable law, and in any case within ninety (90) days of receipt of a complete request.

16. Third-Party Links and Social Media

Our website and apps may contain links to third-party websites, payment pages, and social media platforms (such as Facebook, Instagram, X, LinkedIn, and YouTube). The inclusion of such links does not imply endorsement by Sterling. Those websites and platforms have their own privacy policies and terms, for which Sterling is not responsible. Any content you post publicly on our social media pages may be visible to others; please avoid sharing health information in public forums.

17. Your Responsibilities

You agree to provide accurate, complete, and up-to-date information, not to impersonate another person, and not to provide personal data of another individual without their authority. Sterling shall not be responsible for consequences arising from inaccurate or false information provided by you.

18. Changes to This Policy

We may update this Policy from time to time to reflect changes in law, our practices, or our services. The updated Policy will be posted on our website with a revised "Last Updated" date. Where changes are significant, we will notify you through a prominent notice on our website or through other appropriate means and, where required, seek fresh consent. We encourage you to review this Policy periodically.

19. Governing Law and Jurisdiction

This Policy is governed by the laws of India. Subject to the jurisdiction of the Data Protection Board of India and other statutory authorities, the courts at Ahmedabad, Gujarat shall have exclusive jurisdiction over any dispute arising out of or in connection with this Policy.

20. Contact Us — Data Protection Officer / Grievance Officer

If you have any questions, requests, or grievances regarding this Policy or the processing of your personal data, please contact:

We will acknowledge your grievance promptly and endeavour to resolve it within ninety (90) days. If you are not satisfied with our response, you may approach the Data Protection Board of India in accordance with the DPDP Act and DPDP Rules as applicable from time to time.

Thank you for trusting Sterling Hospitals with your care.