1. Who we are
This policy explains how Vermaco Healthcare (“we”, “us”) handles personal data through vermacohealthcare.com and vermacohealthcare.in. Under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) we are the Data Fiduciary for the data described here, and you are the Data Principal.
2. Where we stand today
Vermaco Healthcare provides revenue cycle management (RCM) and medical billing services. This website is informational. When we handle patient or claims data for a client organisation, we do so as that client’s Data Processor under a written agreement — that processing follows the client’s instructions and the agreement, alongside the safeguards described here.
3. What we collect, why, and on what basis
We collect only what we need for the purposes below. Each purpose is listed separately so you can see exactly what you are agreeing to.
| Data | What exactly | Why | Legal basis |
|---|---|---|---|
| Contact and consultation requests | Name, email address, organisation and anything you choose to write when you email us. | To reply and discuss our services. | Consent |
| Technical data | IP address, browser type, pages requested and timestamps, logged automatically by Netlify. | To run the website securely. | Legitimate use (security) |
| Cookie preference | Whether you accepted or declined optional cookies. | To remember your choice. | Strictly necessary |
| Client data (services) | Patient, insurance and claims data received from client organisations. | Only to perform the RCM services the client has contracted. | Client’s instructions under contract (we act as Data Processor) |
4. What we never do
- We never sell your personal data or use it for advertising.
- We never act on your accounts, devices or messages without your permission.
- We never track, profile or target advertising at children.
5. Who we share data with
We use a small number of service providers (“Data Processors”) who process data only on our instructions, under written terms that require them to protect it: Netlify (website hosting, United States/European Union). Service delivery tools are listed in each client agreement.
We may also disclose data where the law requires it, for example to a court or government authority acting under law.
6. Transfers outside India
Some providers above process data outside India. The DPDP Act permits such transfers except to countries the Government of India restricts by notification; we will stop any transfer to a restricted country.
7. How long we keep data
We keep personal data only as long as needed for the purpose you gave it for, or as the law requires, and then erase it. If you withdraw consent, we stop processing and erase the data unless we must keep it by law. Security logs are kept for one year, as the DPDP Rules require.
8. Your rights
- Access — a summary of the personal data we hold about you and how we use it, and who we have shared it with.
- Correction, completion, updating and erasure of your data.
- Withdraw consent at any time — as easily as you gave it. Withdrawal does not affect processing already done.
- Grievance redressal — a response from our Grievance Officer.
- Nominate someone to exercise your rights if you die or become incapable.
If your personal data reached us through a client (for example, a hospital or clinic), contact that organisation first; we will support them in answering your request. To use any right, email info@vermacohealthcare.com. We may ask you to confirm your identity first.
9. Your duties
The DPDP Act asks Data Principals to give authentic information, not to impersonate anyone, and not to file false or frivolous complaints.
10. Children
Our services are for adults. We do not knowingly collect data from anyone under 18 without verifiable consent from a parent or lawful guardian, and we never track, monitor the behaviour of, or target advertising at children. If you believe a child has given us data without such consent, contact us and we will delete it.
11. Security and breaches
We protect data with encryption in transit (HTTPS), access controls, least-privilege access and activity logs — see our Data Protection Policy. If a personal data breach happens, we will inform affected people and the Data Protection Board of India without delay, and send the Board a detailed report within 72 hours.
12. Cookies and consent
See our Cookie Policy and our Consent & Permission Policy.
Grievance Officer & contact
Grievance Officer: Rajesh Kumar, Founder
Email: info@vermacohealthcare.com
Address: Vermaco Healthcare, Sahibzada Ajit Singh Nagar (Mohali), Punjab, India
We acknowledge requests promptly and resolve them within the time the law allows (currently no more than 90 days) — we aim for 7 working days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
Changes
We will post updates here with a new date, and tell you directly about important changes before they apply.