Skip to Content

Skip to main content

-A A +A

Theme Change

screen-reader

Privacy Policy

1. Purpose and Scope

This Privacy Policy applies to the website nhsrcindia.org, its associated sub-domains and portals operated by the National Health Systems Resource Centre (NHSRC), including but not limited to the Quality and Patient Safety portal (qps.nhsrcindia.org), the Recruitment portal (recruitment.nhsrcindia.org), the Appraisal Application (apa.nhsrcindia.org), and the NGO Grants portal (ngo.nhsrcindia.org) and any other digital medium where personal data is collected and processed.

NHSRC is a technical support institution to the Ministry of Health & Family Welfare (MoH&FW), Government of India, working on public health systems strengthening, policy support, capacity building, and quality assurance in health care (per NHSRC's stated Mission, Vision & Policy Statement). Accordingly, this policy highlights the digital interactions and data processing activities of NHSRC for the public and all stakeholders and data principals, including but not limited to casual website/ digital visitors, RTI applicants, job/ internship applicants, tender bidders, NGO grant applicants, and trainees/ assessors within programs such as NQAS.

2. Information We Collect

2.1 Automatically collected data (all visitors)

When you visit this website, standard log data may be recorded for security and statistical purposes, including IP address/domain, date and time of access, pages visited and files downloaded, and referring page or search engine.

2.2 Information you provide voluntarily

  • Contact/feedback forms/ Details on Recruitment portal/ Details on Internship Applications (e.g., "NHSRC Feedback," "Response – Public Consultation")
  • RTI applications
  • Recruitment and internship applications (Name, D.O.B., contact details, Current and Permanent Address resume/CV, educational and professional history)
  • Tender and grant/NGO empanelment submissions (organisational details, financial and compliance documents)
  • Training/assessor program registrations (e.g., NQAS External Assessor training), which may include professional credentials
  • Email correspondence

2.3Information you provide voluntarily

All personal data collected by NHSRC, including but not limited to, updation of personal records of an individual on a half-yearly basis, is governed uniformly under the Digital Personal Data Protection Act, 2023. Such data is collected and processed solely for the specified lawful purpose based on your explicit consent or other legitimate uses permitted under the Act. NHSRC implements robust technical and organisational safeguards to ensure the security, integrity and prevention of unauthorised access to all processed personal records.

2.4 Cookies and tracking technologies

Essential Cookies:Required for core website functionality, such as maintaining user sessions, security, and accessibility.

Session Cookies:Temporary cookies used to manage user sessions and are automatically deleted when the browser is closed.

Preference and Tracking Cookies:These cookies require your clear affirmative action and explicit consent before deployment, allowing us to store user preferences such as language or display settings or relevant analytical tracking metrics, where applicable.

3. How We Use Your Information

Information is processed only for the specified, lawful purpose for which it was provided, including to:

  • Respond to queries, feedback, and RTI requests
  • Process recruitment, internship, tender, and grant applications
  • Administer training, assessment and certification programs
  • Maintain website security, prevent data breaches and produce aggregate visitor statistics
  • Comply with legal, audit, and government reporting obligations under the applicable laws

We do not use personal information for unrelated purposes. Personal data will not be used for secondary communications or added to mailing lists without your prior explicit and unconditional consent. Data Principals retain the right to withdraw consent for any of these purposes at any time, in accordance with the Digital Personal Data Protection Act, 2023.

4. Legal Basis and Applicable Law

  • The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, serving as the primary legal framework governing all digital data processing.
  • The Information Technology Act, 2000 and surviving rules made thereunder, restricted solely to non-repeating provisions regarding computer systems security and cyber crimes
  • The Right to Information Act, 2005, for RTI-related processing, processed strictly in accordance with the privacy related amendments enacted under Section 44(3) of the DPDP Act
  • Government of India guidelines for websites (GIGW), ensuring institutional web accessibility, administrative quality and design compliance

5. Data Sharing and Disclosure

  • We do not sell or rent personal information.
  • Information may be disclosed to other Government of India departments/agencies where required for the stated purpose (e.g., verification of recruitment eligibility, RTI coordination, or for Medical and Accidental insurance purposes). Such disclosures will be executed strictly in accordance with your explicit consent or applicable legitimate use provisions under the DPDP Act, 2023
  • Information may be disclosed pursuant to a lawful order, warrant, or direction from a court, law enforcement, regulatory body or statutory authority, where such disclosure is legally exempted from consent under Section 7 of the DPDP Act, 2023.
  • Where third-party service providers (e.g., hosting providers, portal software vendors, Online written test agency) process data on NHSRC's behalf, they act as Data Processors. In accordance with Section 8 of the DPDP Act, such Data Processors are bound by a formal legal contract requiring strict data protection, security measures and absolute confidentiality.

6. Data Retention and Erasure

  • In accordance with Section 8(7) of the Digital Personal Data Protection Act, 2023 and Rule 8 of the DPDP Rules, 2025, personal data will be retained only until the specified purpose for its collection is fulfilled or until the Data Principal withdraws their consent, whichever occurs earlier.
  • Data will be retained beyond purpose completion only for the specific duration required by statutory laws, including recruitment records, financial audits, audit trails and the mandatory 1-year retention period for digital access and processing logs.
  • Where data retention is governed by administrative mandates, timelines will strictly adhere to the Government of India record-retention schedules.
  • Upon the expiration of the applicable retention period or the receipt of a valid erasure request, NHSRC will ensure the personal data is permanently and securely deleted from all active servers, backup systems and third-party Data Processor databases or rendered completely anonymised so that the individual can no longer be identified.

7. Data Security

  • NHSRC will implement reasonable technical and organisational security safeguards appropriate to the sensitivity of the data held, in compliance with Section 8(5) of the DPDP Act, 2023 and Rule 6 of the DPDP Rules, 2025.
  • These safeguards extend to all data processed on NHSRC’s behalf by contracted third-party Data Processors.
  • consistent with Government of India IT security guidelines, i.e., Secure communication using HTTPS/TLS encryption, Hosting of servers on MeITYempanelled cloud data centre, role-based access control, strong authentication mechanisms and periodic Vulnerability Assessment and Penetration Testing (VAPT) or independent security audit of portals.

8. Data Breach Notification

  • In the event of a personal data breach, including but not limited to unauthorised access, data exposure or accidental alteration, NHSRC will execute its documented incident response plan
  • Consistent with obligations under Section 8(6) of the DPDP Act and Rule 7 of the DPDP Rules, 2025, NHSRC will notify the Data Protection Board of India without delay via initial report upon becoming aware of the incident.
  • A comprehensive follow-up report detailing the nature, scope and containment measures of the breach will be submitted to the Board within 72 hours of detection
  • Affected individuals/ Data Principals will be notified without delay or within 72 hours following containment, as applicable, provided in clear, plain language outlining the data impacted and recommended protective actions they should take.

9. Your Rights

Subject to applicable law, Data Principals have the right to:

  • Know what personal information is held about them:
  • Request a summary of their personal data being processed, the processing activities undertaken and the identities of any other Data Fiduciaries or Data Processors with whom their data has been shared.
  • Request correction of inaccurate information, completion of incomplete records or updating of outdated personal data.
  • Request deletion (erasure) of their personal data, subject to legal, statutory or administrative record-retention requirements
  • Withdraw consent for processing at any time, as easily as it was given, causing NHSRC and its Data Processors to immediately cease further processing unless authorised by law
  • Nominate any other individual to exercise these rights on their behalf in the event of their death or incapacity.
  • Lodge a grievance regarding handling of their personal data through NHSRC’s grievance mechanism.

Grievance Mechanism

NHSRC has established a Grievance Redressal Mechanism in accordance with the Digital Personal Data Protection Act, 2023, and the rules made thereunder to provide an accessible, transparent, and effective process for addressing grievances relating to the processing of personal data.

NHSRC has established a Grievance Redressal Mechanism in accordance with the Digital Personal Data Protection Act, 2023, and the rules made thereunder to provide an accessible, transparent, and effective process for addressing grievances relating to the processing of personal data.

Upon receipt of a grievance, the Grievance Officer shall acknowledge the grievance, conduct a preliminary examination, and, wherever necessary, place the matter before the DPDP Grievance Redressal Committee for review and appropriate recommendations

The DPDP Grievance Redressal Committee shall comprise the following members:

  1. Principal Administrative Officer (PAO) – Chairperson
  2. Human Resource Manager – Member
  3. Information Technology Manager – Member
  4. One Consultant nominated by the concerned Technical Division – Member

The Committee may seek additional information or clarification from the complainant or the concerned division, examine the facts of the case, and recommend appropriate corrective or remedial measures. Based on the Committee's recommendations, the Grievance Officer shall communicate the final decision to the complainant and make reasonable efforts to resolve the grievance in a fair, transparent, and timely manner in accordance with the provisions of the Digital Personal Data Protection Act, 2023, and the rules made there under

All grievances and the personal data associated with them shall be treated as strictly confidential and processed solely for the purpose of grievance redressal. Appropriate technical and organizational measures shall be implemented to protect such personal data against unauthorized access, disclosure, alteration, loss, destruction, or misuse.

Data Principals must exhaust NHSRC’s internal grievance redressal mechanism before escalating concerns externally. However, if you do not receive a response within the prescribed timelines or if you remain deeply unsatisfied with the final resolution provided by our Grievance Officer, you hold the statutory right to escalate the matter by filing a formal complaint with the Data Protection Board of India (DPBI)

Grievance / Contact

Questions, complaints, requests, or grievances relating to this Privacy Policy or the processing of personal data may be addressed to the designated Grievance Officer/Privacy Contact: Brig. Sanjay Baweja (Retd.), Principal Administrative Officer, National Health Systems Resource Centre (NHSRC), Email: Sanjay.baweja@nhsrcindia.org Phone: 011 -2610 8983 (extension 106)

10. Children's Data

  • NHSRC's website is not directed at children. In accordance with Section 9 of the DPDP Act, 2023 and Rule 10 of the DPDP Rules, 2025, NHSRC does not process the personal data of the individual under 18 years of age without obtaining prior, verifiable consent from the parent or the lawful guardian
  • NHSRC strictly prohibits and does not engage in any processing of personal data that is likely to cause a detrimental effect on the well-being of a child.
  • In compliance with statutory mandates, NHSRC does not undertake tracking, behavioural monitoring or profiling of children nor does it direct any targeted advertisements or promotional content towards individuals under 18 years of age across any of its sub-domains or portals.

11. Changes to This Policy

  • This policy may be revised periodically, at least once every two years or sooner as required to align with regulatory amendments, technical upgrades or changes in our data processing activities. The date of the last update will be prominently displayed at the top of this page.
  • In compliance with Section 5 of the DPDP Act, 2023, where any revision introduces material updates to the categories of personal data collected, the purposes of processing or the rights available to you, NHSRC will provide a proactive notification to all registered Data Principals.
  • Such notices will be delivered through reasonable digital channels, including e-mail alerts, portal dashboard notifications or prominent website banners, accompanied by an updated Consent Notice allowing you to review and reaffirm your choice.

12. Linguistic Options and Accessibility

In compliance with Section 5(3) of the DPDP Act, 2023, this Privacy Policy, alongside all associated consent notices, is available in English and Hindi. Users may switch the display language using the language toggle option present on the portal header before providing consent. Users may switch the display language using the language toggle option present on the portal header before providing consent.

13. Consent Management Platform Integration

In accordance with Section 6(7) of the Act and Rule 4 of the DPDP Rules, 2025, Data Principals interacting with NHSRC portals have the right to give, review, manage or withdraw their consent through a registered Consent Manager. Any consent modification or erasure request initiated by an individual via an authorized, interoperable Consent Manager platform will be dynamically synced and honoured by NHSRC’s databases without undue delay.

14. Processing Under Legitimate Uses

While explicit consent is our primary baseline, NHSRC may process digital personal data without separate consent strictly for specific legitimate uses, as permitted under Section 7 of the DPDP Act, 2023. This is strictly confined to executing functions mandated under Indian law, fulfilling orders issued by a court or statutory tribunal or responding to public health exigencies and medical emergencies.

15. Consent on Behalf of Persons with Disabilities

In compliance with Section 9(1) of the Act and Rule 11 of the DPDP Rules, 2025, where a Data Principal is a person with a disability that prevents them from executing independent digital transactions, personal data will be processed only upon obtaining the verifiable consent of their legally appointed or lawful guardian, who shall be authorized to exercise all Data Principal rights on their behalf.