Sunny Hills Private Limited (“Sunny Hills”, “we”, “us”, or “our”) is committed to protecting the privacy and dignity of Sunny Hills Retirement Home (“Green Gardens”) residents, their families, our staff, and visitors to our website. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have over your data under the Digital Personal Data Protection Act, 2023.
1. Scope of This Policy
This Policy applies to:
- Residents of Sunny Hills Retirement Home (“Green Gardens”) and their health, medical, and daily care data;
- Family members and guardians who access our Family Portal or communicate with us;
- Visitors to our website and users of our enquiry forms;
- Staff, caregivers, and contractors, to the extent their data is processed in connection with resident care;
- Anyone who contacts us via phone, WhatsApp, email, or social media.
2. Personal Data We Collect
2.1 Data you provide directly
| Category | Examples |
|---|---|
| Identity Data | Full name, date of birth, gender, photograph, government ID (Aadhaar/Passport/PAN) |
| Contact Data | Address, phone number, WhatsApp number, email address, country of residence |
| Health & Medical Data | Medical history, current diagnoses, medication records, allergies, mobility status, vitals (heart rate, blood pressure, SpO2, sleep), care level requirements |
| Family & Emergency Contact Data | Names, relationships, contact details, and consent records of family members or guardians |
| Financial Data | Billing address, payment records (processed via secure payment gateway and we do not store card numbers) |
| Communication Data | Messages sent via our enquiry form, WhatsApp, email, or social media |
2.2 Data Collected Automatically or via Technology
| Category | Examples |
|---|---|
| CCTV Footage | Video recordings from cameras placed in common areas, corridors, and entry points (never in private rooms or bathrooms) |
| Wearable Device Data | Heart rate, sleep quality, activity levels, and fall-detection alerts from resident wearables |
| Website Usage Data | IP address, browser type, pages visited, time spent, via cookies and analytics tools |
| Smart Access Data | Entry/exit logs from biometric access control and visitor management systems |
3. How We Use Your Data
We process personal data only for the following purposes, and only to the extent necessary:
- To provide and coordinate resident care, including medical, nutritional, and daily living support;
- To communicate with families through the Family Portal, WhatsApp updates, and AI-generated report cards;
- To operate emergency response systems (panic buttons, fall detection, nurse alerts);
- To process admissions, billing, and contractual obligations under the Resident Admission Agreement;
- To comply with legal and regulatory obligations (health authorities, fire safety, labour law);
- To respond to enquiries submitted via our website or social media;
- To improve our services through aggregated, anonymised analytics;
- To send updates about Sunny Hills (“Green Gardens”), where you have opted in to such communication.
4. Legal Basis for Processing
Under the DPDP Act, 2023, we process personal data on the following grounds:
- Consent: For most data processing, including health data, family portal access, and marketing communications, we rely on your free, informed, and specific consent.
- Legitimate Use: For limited purposes such as responding to your enquiry or fulfilling a contract you have requested, in accordance with Section 7 of the DPDP Act.
- Legal Obligation: Where processing is required to comply with applicable law (e.g., health authority reporting, labour law compliance).
5. Consent for Residents Lacking Capacity
Where a resident is unable to provide informed consent due to a medical condition (such as advanced dementia), we obtain consent from their lawful guardian or the family member authorised under the Resident Admission Agreement, in accordance with Section 9 of the DPDP Act governing data principals who require assistance. Consent is documented in writing and may be withdrawn at any time by the authorised guardian.
6. CCTV and Surveillance
We maintain surveillance to ensure security and safety across our sanctuary:
- Cameras are installed only in common areas, corridors, dining halls, and entry/exit points.
- Cameras are never installed in private bedrooms, bathrooms, or changing areas.
- Footage is used solely for resident safety, incident review, and anomaly detection.
- Footage is retained for a maximum of 30 days unless required for an active investigation, after which it is automatically deleted.
- Access to footage is restricted to authorised security and care management personnel.
8. Data Storage, Security, and Retention
- All data is stored on secure, access-controlled cloud servers with encryption in transit and at rest.
- Access to resident health data is restricted to authorised care staff on a need-to-know basis.
- Resident data is retained for the duration of residency and for 8 years thereafter, in line with medical record-keeping norms, after which it is securely deleted or anonymised.
- Website enquiry data is retained for 2 years from the last contact, unless an active relationship continues.
- In the event of a data breach likely to cause harm, we will notify affected individuals and the Data Protection Board of India in accordance with the DPDP Act and other regulations if any applicable at the time.
9. Your Rights as a Data Principal
Under the DPDP Act, 2023, you (or your authorised guardian) have the right to:
- Access a summary of the personal data we hold about you and how it is processed;
- Correct, complete, or update inaccurate or outdated personal data;
- Erase personal data that is no longer necessary for the purpose it was collected, subject to legal retention requirements;
- Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
- Nominate another individual to exercise these rights on your behalf in the event of death or incapacity;
- Lodge a complaint with the Data Protection Board of India if you believe your rights have been violated.
To exercise any of these rights, contact our Grievance Officer using the details in Section 11.
11. Grievance Officer & Contact
If you have any questions, concerns, or requests regarding this Policy or your personal data, please reach out to our designated Grievance Officer:
Beena Mathew
Acknowledge within 7 business days; resolve within 30 days
12. Updates to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The “Effective Date” at the top of this document will be updated accordingly. Material changes affecting resident health data will be communicated directly to residents and their authorised family members.