This policy explains what personal data SunCrest (“we”, “us”) collects, why, how we protect it, and the choices and rights you have. It has two parts: Part A covers visitors to this website, and Part B covers patients and customers of our clinics, pharmacies and laboratories.
1. Who we are
SunCrest operates clinics, pharmacies and diagnostic laboratories under the SunCrest name, and this website, suncrestmed.com (the “Website”).
For the personal data described in this policy, we decide why and how it is processed. Under the Digital Personal Data Protection Act, 2023 (the DPDP Act), that makes us the “Data Fiduciary”.
2. Part A: Website visitors. What we collect
You can read this Website without giving us any personal information. It has no sign-up, no contact form and no comments. We do not ask you to create an account.
When you visit, the following is collected automatically:
- Anonymous usage statistics (see section 4): the pages you view, the page that referred you, your approximate country, and your device, browser and screen type.
- Server logs kept by our hosting provider for security and reliability: your IP address, the date and time of the request, the page requested and your browser's user-agent text.
We do not use this information to identify you personally, and we do not combine it with the health or customer records described in Part B.
4. Analytics
We use Vercel Web Analytics to understand which pages are useful and how to improve the Website. It is designed to be privacy-friendly: it does not use cookies, does not track you across websites, and does not build a profile of you. As described by the provider, it uses a short-lived anonymous identifier that is discarded within 24 hours, and it does not store your IP address.
The results are reviewed in aggregate. We do not sell them, and we do not use them to send you marketing.
5. Links to other services
The Website contains links that open other services, such as your phone dialler, WhatsApp, an email app or a maps service. When you use them, you leave our Website and that service's own privacy policy applies.
6. Part B: Patients and customers. What we collect
When you use our clinic, pharmacy or laboratory, we collect the personal data needed to look after you and bill you. Depending on the service, this includes:
- Identity and contact details: name, age or date of birth, sex, mobile number and, if you give them, email address, city and address.
- Family members: if you register family members (dependants) under your mobile number, their details too.
- Health information: symptoms and history you tell us, vitals measured at the clinic (such as temperature, pulse, blood pressure, oxygen level, weight and height), known allergies and conditions, visit notes, prescriptions you show the pharmacy, tests ordered, samples collected and test reports.
- Billing information: items billed, amounts, GST, payment mode (cash, UPI or card) and payment references. We do not store your full card number, card PIN or UPI PIN.
- Communication details: whether you agreed to receive messages on WhatsApp, and the messages we send you, such as a copy of your bill or a link to your report.
- Security records: logs of which staff member viewed or changed a record, kept for audit.
7. Why we use your data
- To provide, coordinate and follow up on your care across our clinic, pharmacy and laboratory.
- For your safety: for example, allergy alerts before a medicine is sold, expiry checks, and tracing a lab sample from collection to report.
- To prepare bills, take payments, keep accounts and meet tax obligations, including GST.
- To send you your bill or report, and, only if you agreed, service messages on WhatsApp.
- To meet legal and regulatory duties, such as keeping the records that medical, pharmacy and laboratory law require.
- To keep our systems secure, prevent fraud and misuse, and audit our own work.
We use your data only for these purposes, or for a purpose we tell you about at the time and, where the law requires it, ask your consent for.
8. The basis on which we process your data
We process your personal data with your consent, or for the other legitimate uses the DPDP Act permits. These include situations where you have voluntarily given us your data for a service you asked for, responding to a medical emergency, and complying with the law.
When we ask for your consent, we will tell you what data we need and why, in clear language, and you can withdraw it as described in section 13.
9. One record across SunCrest
Your mobile number links your records at SunCrest clinics, pharmacies and laboratories. This lets staff at one location see relevant details recorded at another, such as allergies or earlier visits, so that we can treat and bill you safely and avoid repeating questions or tests.
Access is limited by role: staff can see only what their job needs, each person uses their own account, and sensitive actions are logged.
10. Family members and children
If you give us details of another person, including a child or a family member who cannot decide for themselves, you confirm that you are their parent, lawful guardian or otherwise authorised to do so.
We do not aim this Website at children. For a person under 18, we process personal data only with the verifiable consent of a parent or lawful guardian, as the law requires, and we do not track or target children with advertising.
12. Where your data is kept, how long, and how we protect it
Location. We use secure cloud services to store data. Those servers may be located outside India. We transfer personal data only where the law permits and we require our providers to apply appropriate safeguards.
Retention. We keep personal data for as long as needed for the purposes in section 7 and to meet legal requirements for medical, pharmacy, laboratory, tax and accounting records. After that, we erase it or make it anonymous, unless the law requires us to keep it.
Security. We apply reasonable security safeguards, including encrypted (HTTPS) connections, individual staff accounts, role-based access, audit logs of sensitive actions, and restricted access to our internal systems. No system is perfectly secure. If a personal data breach affects you, we will notify you and the authorities as the law requires.
13. Your rights
Under the DPDP Act, you have the right to:
- get a summary of the personal data we hold about you and how we are processing it, and who we have shared it with;
- ask us to correct, complete or update your personal data;
- ask us to erase your personal data, unless we need to keep it for a legal reason or the purpose it was given for;
- withdraw your consent at any time. This will not affect what we did before you withdrew, and we will tell you how it affects the services we can provide;
- have your complaint about our handling of your data addressed through our grievance process (section 14); and
- nominate another person to exercise these rights for you if you die or become unable to do so.
To use any of these rights, tell the front desk at any SunCrest location or contact us as set out in section 14. We may need to confirm who you are before we act, to protect your privacy.
14. Questions, complaints and our Grievance Officer
Please send any question, request or complaint about your personal data to our Grievance Officer through the front desk of any SunCrest location (see Visit us).
We aim to acknowledge your message within 48 hours and to resolve it within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India once the grievance process with us is complete.
15. Changes to this policy
We may update this policy as our services or the law change. The date at the top shows when it was last updated (17 October 2026). If a change materially affects how we use your personal data, we will tell you in a suitable way, for example on the Website or at our locations.
Please also read our Terms of Use.
See also our Terms of Use.