Privacy Policy

Last updated: 1 September 2026

In short We collect only what we need to treat you and run the hospital. We never sell your data. Your medical records are shared with your treating team and, where you have authorised it, your insurer — and with nobody else unless the law requires it.

1. Who we are

CM Hospital – Multi-Speciality & Trauma Centre ("CM Hospital", "we", "us") operates the hospital at Pillar No. 27-28, opposite Pantaloons Mall, Bailey Road, Jyotipuram Colony, Khajpura, Patna, Bihar 800014 and this website. For any question about this policy or your data, contact our Data Protection Officer at care@cmhospitalpatna.in or call +91 90316 83522.

2. Information we collect

Information you give us

Identity and contact details — name, age, gender, address, phone number, email, photo ID and next-of-kin details
Health information — symptoms, history, examination findings, investigation results, diagnoses, prescriptions, operation notes and discharge summaries
Financial information — billing details, insurance policy and scheme numbers, and payment records
Website submissions — anything you enter in our appointment, contact, feedback or careers forms

Information collected automatically

Server logs including IP address, browser type, pages visited and timestamps
Session cookies required for form security (CSRF protection) — these expire when you close your browser
CCTV recordings in public areas of the hospital, retained for a limited period for safety and security

This website does not use advertising cookies or third-party tracking pixels. Fonts and icons are loaded from public content delivery networks, and photographs from an image CDN; those providers may log your IP address as a normal part of serving the file.

3. Why we use your information

To diagnose and treat you, and to coordinate care between departments
To confirm appointments, send reports and give follow-up reminders
To process billing, insurance pre-authorisation and scheme claims you have asked us to file
To meet legal, regulatory and accreditation obligations, including notifiable disease reporting
To improve quality and safety through internal audit of anonymised or aggregated data
To respond to your enquiries, feedback and complaints
To consider your application if you apply for a job with us

4. When we share information

We share your information only in these circumstances:

Your treating team — doctors, nurses, technicians and therapists directly involved in your care
Your insurer or TPA — when you have asked us to process a cashless claim or reimbursement
Referral and diagnostic partners — where a test or procedure is performed outside our campus at your consultant's advice
Regulators and authorities — where required by law, court order, or public health reporting obligations
Service providers — such as our hospital information system vendor, bound by confidentiality agreements and processing data only on our instructions

We never sell your personal or health data, and we do not share it for marketing purposes.

5. Confidentiality of sensitive care

Records relating to mental health, HIV status, substance use, sexual health and termination of pregnancy are held with restricted access. They are not shared with family members or employers without your specific written consent, except where the law compels disclosure or there is an immediate risk to life.

6. How long we keep records

Inpatient and outpatient medical records: at least three years from the last visit, and longer where regulation, litigation, implants or cancer care require it
Imaging: archived digitally for a minimum of three years
Website form submissions: up to twelve months, and up to six months for job applications
Server logs: up to ninety days
CCTV footage: up to thirty days unless retained for an investigation

7. How we protect your information

Role-based access control in the hospital information system, with individual login accounts and audit trails
Encrypted transmission for portal access and insurer communication
Physical records stored in access-controlled areas of the medical records department
Confidentiality undertakings signed by every employee, and annual privacy training
Regular backups with restricted restoration rights

No system is completely secure. If a breach affecting your data occurs, we will inform you and the relevant authorities as required by law.

8. Your rights

Access — request a copy of your medical records through the medical records department
Correction — ask us to correct factual errors such as a wrong date of birth or spelling
Withdraw consent — for non-essential communication such as newsletters, at any time
Object — to any use of your data that is not required for your care or by law
Complain — to our Data Protection Officer, and then to the relevant authority if unsatisfied

Clinical findings and professional opinions recorded by a doctor cannot be deleted or altered, as the integrity of the medical record is a legal requirement.

9. Children's information

For patients under eighteen, information is provided to and consent obtained from a parent or legal guardian, with the child involved in decisions in a manner appropriate to their age and understanding.

10. Changes to this policy

We review this policy annually. Material changes will be posted on this page with a revised date, and a notice will be displayed at our reception.

11. Contact

Data Protection Officer, CM Hospital – Multi-Speciality & Trauma Centre, Pillar No. 27-28, opposite Pantaloons Mall, Bailey Road, Jyotipuram Colony, Khajpura, Patna, Bihar 800014
Email: care@cmhospitalpatna.in · Phone: +91 90316 83522