PRIVACY POLICY

At CertiGen (Corporate Health & Testing Division of Shree Ananta Hospital), we respect the privacy of our corporate clients, their HR/EHS teams, and the individual employees whose health examinations we conduct.

This Privacy Policy outlines how CertiGen collects, processes, stores, discloses, and safeguards personal health information (PHI) and corporate data gathered during our onsite medical camps, statutory fitness examinations (Factories Act 1948, FSSAI Schedule IV), and corporate health drives across India.

We strictly adhere to applicable Indian privacy legislation, including the Digital Personal Data Protection Act (DPDP Act, 2023) and the Information Technology Act, 2000 (and its relevant Sensitive Personal Data or Information Rules).

INFORMATION WE COLLECT

1. Employee Health & Demographic Information

• Personal Identifiers: Full name, employee ID, age, gender, contact number, plant/facility location, designation, and department.
• Clinical & Diagnostic Data: Blood pressure readings, vision/color blindness test results, audiometry data, spirometry (PFT) readings, ECG charts, chest X-rays, blood/urine/stool pathology test values, skin screening notes, and vaccination history.
• Medical Fitness Outcome: Doctor-certified fitness status (Form 32, Form 33, FSSAI Health Certificate, or General Fit/Unfit status).

2. Corporate & Client Contact Information

Corporate entity name, registered office address, plant locations, billing details, and contact details of authorized HR, EHS (Environment, Health & Safety), and medical room personnel.

HOW WE USE YOUR INFORMATION

We process collected data exclusively for explicit, legitimate, and legally mandated purposes:

• 1. Fulfilling Statutory Health Audits: Generating legally valid medical fitness certificates required under The Indian Factories Act, 1948 and FSSAI Schedule IV regulations.
• 2. Delivering Diagnostic Results: Uploading individual medical reports and compiled location-wise health dashboards to the employer’s secure digital vault.
• 3. Medical Officer Review: Enabling certified Medical Officers from Shree Ananta Hospital and partner NABL labs to evaluate and verify test results.
• 4. Administrative & Operations Management: Managing camp schedules, sample logistics, billing, and post-screening follow-up communication.

DATA SHARING & DISCLOSURE

We do NOT sell, rent, trade, or monetize personal health data under any circumstances.

We share data only under strict, controlled scenarios:

• With Employers / Authorized Corporate HR: Employee fitness certificates and health reports are shared directly with designated HR/EHS representatives via encrypted digital vault access as contractually agreed for employment compliance.
• With Accredited Clinical Partners: Biological samples and diagnostic data are shared strictly with NABL-accredited diagnostic laboratories and certified radiologists/doctors involved in processing the tests.
• Legal Requirements: We may disclose health records if required by law, court order, or formal request from government statutory labor/health auditors under valid legal authority.

DATA STORAGE & RETENTION

• Retention Period: Employee medical reports and statutory fitness records are retained for the duration required by applicable statutory regulations (e.g., Factories Act record retention mandates) or as specified in our service contract with the employer.
• Secure Storage: All digitized records are maintained in encrypted cloud storage environments with strict location-wise folder access permissions.
• Safe Deletion: Once the mandatory retention period expires or upon authorized contract closure, physical and digital records are securely purged or anonymized following standard biomedical data disposal guidelines.

SECTION 6: INDIVIDUAL RIGHTS & CONSENT

• Explicit Consent: Prior to sample collection or physical examination, employees/workers are informed of the screening purpose, and consent is obtained.
• Access to Records: Employees can request access to their individual health reports through their employer’s HR department or by contacting CertiGen’s privacy officer.