Privacy Policy

Last updated: 10 September 2026

This notice explains how Infinity Medical Centre collects, uses, shares, protects and retains your personal data, and what rights you have under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the rules made under it.

It applies to both of our centres — IMC 1 (Parel), our diagnostic imaging division, and IMC 2 (Sewri), our theragnostics and nuclear medicine division — and to our website, our appointment booking forms, our telephone lines and our WhatsApp messaging.

In brief

●      We are a diagnostic and nuclear medicine centre, so most of what we hold about you is health data. We treat it as the most sensitive information in our care.

●      We send appointment confirmations, reschedules, cancellations, reminders and post-visit feedback requests over WhatsApp. Those messages pass through WhatsApp/Meta’s systems, which are outside India. See the WhatsApp section — and you can opt out at any time.

●      Pred Healthcare Solutions LLP runs our patient records and messaging platform for us as our Data Processor, strictly under our instructions and under contract.

●      We do not sell your personal data, and we do not use it for third-party advertising.

●      You can ask us what we hold, ask us to correct it, ask us to erase it, withdraw your consent, and nominate someone to act for you.

●      If something goes wrong, contact our Grievance Officer.

Contents

1. Who we are
2. The words the law uses
3. What personal data we collect
4. Health data and why we treat it as special
5. Why we use your data — consent and legitimate uses
6. WhatsApp messaging — please read this section
7. Who we share your data with
8. Transfers outside India
9. How long we keep your data
10. How we protect your data
11. Children and people with a lawful guardian
12. Records the law requires us to keep
13. Your rights as a Data Principal
14. Your duties as a Data Principal
15. Consent Managers
16. Our website, booking forms and cookies
17. Grievance Officer and how to complain
18. Changes to this notice
19. Contact us

1. Who we are

Infinity Medical Centre is a diagnostic imaging and nuclear medicine provider in Mumbai, established at Parel (E) in May 2011. We operate two centres:

●      IMC 1 — Parel (Diagnostic Divisions): MRI, CT, digital X-ray, ultrasound and colour Doppler, mammography, OPG, fetal medicine services, fibroscan, DLCO, stress test / ECG / PFT, and health check-up packages.

●      IMC 2 — Sewri (Theragnostics Divisions): nuclear medicine imaging — PET-CT, SPECT (gamma scan), renal, neuro and targeted imaging — and radionuclide therapy.

For the purposes of the DPDP Act, Infinity Medical Centre is the Data Fiduciary for the personal data described in this notice. Our full legal identity is:Infinity Medical Centre, a Unit of B.N.T IMAGING PRIVATE LIMITED, Gr. Flr, Citi Home, Opp. Ashok Garden, Street No.61-A, Dr.S.S Rao Rd, Parel , Mumbai, Maharashtra, India – 400012.

2. The words the law uses

Data Principal

You — the individual the personal data is about. If the patient is a child or a person with a disability who has a lawful guardian, the Data Principal includes the parent or lawful guardian.

Data Fiduciary

Us. We decide why and how your personal data is handled, so the law places the responsibility for it on us.

Data Processor

An organisation that handles personal data on our behalf and under our instructions — for example, the technology partner that runs our patient records and messaging system. A Data Processor may not use your data for its own purposes.

Consent Manager

A platform registered with the Data Protection Board of India through which a Data Principal can give, manage, review and withdraw consent. See section 15.

Data Protection Board of India

The regulator established under the DPDP Act, which you may approach if we do not resolve your complaint.

3. What personal data we collect

3.1 Data you give us

●      Who you are and how to reach you: name, age or date of birth, sex, mobile number, alternative or attendant’s phone number, email address, postal address.

●      Identification: a government-issued identity document where a test, a therapy, an insurance claim or the law requires us to verify your identity. We record only what is necessary.

●      Referral details: the name and contact details of the doctor who referred you, and the prescription or requisition they wrote.

●      Clinical information you tell us: your symptoms, medical and surgical history, current medication, allergies, implants and devices (important for MRI safety), pregnancy or breastfeeding status, previous scans and reports, and, for nuclear medicine, details relevant to radiopharmaceutical dosing.

●      Payment details: the amount paid, the mode of payment, invoice and receipt details, and insurance or third-party administrator (TPA) details if you ask us to bill a claim. We do not store your full card number or your banking credentials.

3.2 Data we create about you

●      Images and studies: MRI, CT, X-ray, ultrasound, mammography, OPG, PET-CT and SPECT images and the associated technical data.

●      Reports and findings: the radiologist’s or nuclear medicine physician’s report, addenda and corrections.

●      Radiation and radiopharmaceutical records: for nuclear medicine and therapy, records of the radiopharmaceutical administered and the dose, which we are required to maintain for radiation safety purposes.

●      Appointment and visit records: when you booked, when you attended, what was performed, what was reported and when.

●      Communication records: our record of the WhatsApp messages, SMS messages, emails and calls between us — including delivery and read status for messages we send you.

3.3 Data collected automatically or incidentally

●      Website and booking form data: what you type into our enquiry or appointment forms, and basic technical information your browser sends (see section 16).

4. Health data and the extra care we choose to take

Almost everything we hold about you is health data: what you were scanned for, what was found, what you were treated with. On the IMC 2 side this frequently includes cancer diagnosis and cancer therapy.

The DPDP Act protects all personal data to a single standard and does not create a separate legal category of “sensitive” data. Separately, however, information about your medical records, medical history and physical or mental health condition is classified as sensitive personal data or information under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and is also protected by our doctors’ professional duty of medical confidentiality.

In practice this means we apply our strictest handling to your clinical data: access is restricted to the staff and doctors who need it for your care, it is not used for marketing, and it is never sold.

5. Why we use your data — consent and legitimate uses

Under the DPDP Act we may process your personal data with your consent (section 6), or for certain legitimate uses (section 7) — which include data you voluntarily provide to us for a specified purpose, and processing needed to respond to a medical emergency involving a threat to life or to health.

We do not sell your personal data, rent it, trade it, or use it for behavioural advertising or profiling.

6. WhatsApp messaging and cross-border transfer

We use WhatsApp to keep in touch with you about your appointments. This section explains exactly what that involves, because WhatsApp messages travel through systems that we do not own or control.

6.1 What we send you on WhatsApp

●      Appointment confirmations — confirming that your appointment is booked, with the centre, date and time.

●      Reschedules — if your appointment time or centre changes, or if you ask us to move it.

●      Cancellations — confirming an appointment has been cancelled.

●      Reminders — a reminder before your appointment, which may include preparation instructions such as fasting, hydration or medication advice for your scan.

●      Post-visit feedback requests — a short request for feedback on your visit.

6.2 Which number we message from

Our WhatsApp messages are sent from +91 22 6917 2424. Depending on your handset and whether you have saved the number, the message may appear under our name or simply as the number with a “Business Account” label. If you receive a message claiming to be from us from any other number, please do not act on it — call us on the numbers in section 19 to check.

6.3 Who else handles these messages

To send these messages we use the WhatsApp Business Platform, a service operated by WhatsApp LLC and its affiliates (the Meta group of companies). This means:

●      Your mobile number, the content of the message, and information about delivery and read status are handled by WhatsApp/Meta in order to deliver the message to your handset.

●      Because we use Meta’s cloud-hosted messaging service, Meta is technically able to access the content of these messages. Meta handles this information under its own terms and privacy policy, which we do not control and cannot change.

●      This processing takes place on servers outside India. See section 8.

●      Our technology partner operates the messaging system on our behalf, as our Data Processor.

Please treat WhatsApp as a convenient but not fully private channel. Anyone with access to your phone may be able to read messages we send you.

6.4 What we do not send on WhatsApp

We keep clinical detail in WhatsApp messages to a minimum. All clinical data shared is encrypted or password protected.

6.5 How to opt out of WhatsApp messages

You can stop our WhatsApp messages at any time, free of charge, and you do not have to give a reason. Choose whichever is easiest:

●      Reply to the message with the word STOP.

●      Tell our reception at either centre when you next visit, or ask over the phone.

●      Call us on 022 6917 2424 (Parel) or 022 6917 2400 (Sewri).

●      Email us at info@infinitymedicalcentre.co.in, or write to our Grievance Officer.

We will act on your request as quickly as we reasonably can. A message that was already queued may still reach you shortly after you opt out.

What happens after you opt out. Opting out of WhatsApp does not cancel your appointment and does not affect your care in any way. We will still need to contact you about your appointment, your preparation instructions and your results — we will simply do so by telephone or SMS instead. If you would rather not be contacted at all about a particular appointment, please tell us, and please understand that we may then be unable to warn you about a change of time or a safety instruction.

Opting out of messages does not delete the records we are legally required to keep. If you want your data erased, see section 13.

6.6 If you message us first

Our website also offers “chat on WhatsApp” links to our centre mobile numbers (86868 60745 for Parel and 80921 21212 for Sewri). If you start a WhatsApp conversation with us on any of our published numbers, we will receive and keep a record of that conversation, including anything you choose to send us. Please do not send us detailed clinical information, reports or images over WhatsApp unless a member of our staff has asked you to.

6.7 Keeping your number correct

We send messages to the number you gave us. Please tell us promptly if your mobile number changes, so that appointment information does not reach someone else. If you share a handset with another person and would prefer we did not send appointment messages to it, tell us and we will note that on your record.

7. Who we share your data with

We share your personal data only where it is necessary, and only with the following:

●      Our doctors, radiologists, nuclear medicine physicians, technologists and clinical staff, for your care.

●      Your referring doctor or hospital — we send your report, and where relevant your images, to the doctor or institution that referred you. If you do not want your report sent to your referring doctor, tell us before your scan.

●      Our technology partner. Our patient records, reporting, billing and messaging platform is provided and operated by a technology partner acting as our Data Processor. They process your data strictly on our written instructions, under a contract that requires appropriate security safeguards, prohibits them from using your data for their own purposes, and requires deletion or return of the data at the end of the engagement.

●      WhatsApp LLC / Meta Platforms — for delivering WhatsApp messages, as described in section 6.

●      Telecom and SMS providers — for text messages and calls.

●      Partner laboratories, teleradiology reporting doctors and equipment service engineers, where a test or a second opinion is performed outside our centre, or where a service engineer needs supervised access to a machine holding images.

●      Insurers and third-party administrators (TPAs), only where you ask us to process a cashless or reimbursement claim, and only to the extent needed for that claim.

●      Your employer or a corporate sponsor, if your health check-up is paid for by them.

●      Payment processors and banks, for taking and reconciling payment.

●      Regulators, courts, police and other authorities, where the law requires or permits it — see section 12.

●      Our professional advisers — auditors, insurers and lawyers — where necessary and under a duty of confidence.

We do not share your data with anyone else without your consent, and we do not disclose your attendance or your findings to family members, employers or third parties who ask, unless you have authorised it or the law requires it.

8. Transfers outside India

Most of your data stays in India. There are two exceptions you should know about:

●      WhatsApp messages are processed by WhatsApp/Meta on infrastructure outside India, as described in section 6.

●      Certain support or software services we use may be provided from outside India under contract.

Section 16 of the DPDP Act permits transfer of personal data outside India, except to any country or territory that the Central Government restricts by notification. We will comply with any such restriction, and we require appropriate contractual protection for data handled outside India.

9. How long we keep your data

We keep your data only for as long as we need it for the purpose we collected it, or for as long as the law requires — whichever is longer. When neither applies, we erase it or make it permanently non-identifiable.

●      Medical records, reports and imaging studies: retained in line with the record-keeping requirements applicable to clinical establishments and to registered medical practitioners in Maharashtra.Records required under the PC-PNDT Act and the AERB radiation safety framework: retained for the period those laws prescribe (see section 12). These cannot be deleted on request.

●      Billing, invoice, GST and accounting records: retained for the period required by tax and company law.

●      Appointment and communication records, including WhatsApp message logs: Note that WhatsApp/Meta retain their own records under their own policies, and any copy of a message on your own handset stays there until you delete it.

●      Website enquiry and booking form submissions: kept only for as long as needed to deal with the enquiry, and then deleted if they do not become part of a patient record.

Where you withdraw your consent, section 8(7) of the DPDP Act requires us to erase your personal data unless retention is necessary for compliance with any law. In a healthcare setting, that exception applies to much of your clinical record — so we will normally restrict access to it rather than delete it, and we will explain to you exactly what we have kept and why.

10. How we protect your data

Section 8(5) of the DPDP Act requires us to take reasonable security safeguards to prevent a personal data breach. The measures we apply include:

●      Access to patient records limited to authorised staff, on a need-to-know basis, using individual named logins — not shared accounts.

●      Encryption of data in transit between your device, our systems and our technology partner’s systems.

●      Audit logging of access to clinical records.

●      Written contracts with every Data Processor requiring equivalent safeguards.

●      Physical security and controlled access to reporting, console and server areas.

●      Confidentiality obligations and periodic privacy training for our staff.

●      Backups, and periodic review of our systems and access rights.

If there is a breach. If a personal data breach occurs, we will notify the Data Protection Board of India and each affected Data Principal in the manner and within the time required by the DPDP Act and the rules made under it, and we will tell you what happened, what data was involved, and what you can do about it.

11. Children and people with a lawful guardian

We regularly scan children and people who are supported by a lawful guardian. Section 9 of the DPDP Act requires that, before processing the personal data of a child under 18, or of a person with a disability who has a lawful guardian, we obtain verifiable consent from the parent or lawful guardian.

●      Where the patient is under 18, we take consent from, and correspond with, the parent or lawful guardian, and we may ask for proof of identity and of the relationship.

●      We do not undertake tracking or behavioural monitoring of children, and we do not direct advertising at children.

●      Appointment messages relating to a child are sent to the number given by the parent or guardian. Please make sure that number is correct and current.

12. Records the law requires us to keep

Some of our record keeping is not a choice, and we cannot delete these records at your request:

●      Ultrasound in pregnancy — the PC-PNDT Act, 1994. If you undergo an ultrasound or fetal medicine scan during pregnancy, we are required by the Pre-Conception and Pre-Natal Diagnostic Techniques (Prohibition of Sex Selection) Act, 1994 and the rules made under it to record specified details in the prescribed form, to preserve those records for the prescribed period, and to make them available to the Appropriate Authority on demand. Determination or disclosure of the sex of the foetus is prohibited by law, and we do not do it under any circumstances.

●      Radiation and radiopharmaceutical records — AERB. As a licensed diagnostic imaging and nuclear medicine facility, we maintain records of equipment, of radiopharmaceuticals administered, and of radiation dose, as required by the Atomic Energy Regulatory Board.

●      Clinical establishment and medical council record keeping. We maintain patient records for the minimum periods required of clinical establishments and of registered medical practitioners.

●      Courts, police and statutory authorities. We will disclose records where we are compelled to by a court order, a lawful direction from a statutory authority, or a legal obligation.

●      Notifiable conditions and public health. Where a condition is notifiable, or where processing is necessary in the interest of public health or in response to an epidemic or outbreak, we will share the information the law requires, as permitted by section 7 of the DPDP Act.

13. Your rights as a Data Principal

Under the DPDP Act you have the following rights. All of them are free to exercise.

13.1 Right to information about your data (section 11)

You can ask us for a summary of the personal data we hold about you, how we are processing it, and the identities of the other Data Fiduciaries and Data Processors with whom we have shared it, together with a description of what was shared.

13.2 Right to correction, completion, updating and erasure (section 12)

You can ask us to correct inaccurate or misleading data, complete incomplete data, update out-of-date data (for example, a changed mobile number or address), and erase data we no longer need.

An important point about clinical records: we can and will correct demographic and administrative errors. A clinical finding, however, is a professional record of what was observed at a point in time — we cannot rewrite it. If you disagree with something in your report, tell us: the reporting doctor will review it, and where a correction is warranted it will be issued as a dated addendum or corrected report, so that the record remains complete and honest.

13.3 Right to withdraw consent (section 6(4))

Where we rely on your consent, you may withdraw it at any time, and withdrawing it must be as easy as giving it was. Withdrawal does not affect anything lawfully done before you withdrew. Please note that some consequences of withdrawal — for instance, our being unable to notify you of a change to your appointment — will fall on you.

13.4 Right of grievance redressal (section 13)

You can complain to us about how we have handled your data or your rights request. See section 17.

13.5 Right to nominate (section 14)

You may nominate another individual to exercise your rights under the DPDP Act on your behalf if you die or become unable to act for yourself. This can matter a great deal in a healthcare setting. To make a nomination, contact our Grievance Officer.

13.6 How to exercise your rights

●      Contact our Grievance Officer, or email info@infinitymedicalcentre.co.in, or ask at the reception of either centre.

●      Tell us clearly what you want and which centre you attended, and give enough information for us to find your record (your name, mobile number, and approximate date of visit).

●      We will verify your identity before we disclose or change anything — this protects you. If you are acting for someone else, we will ask for proof of your authority.

●      We will respond within 30 days of receiving a complete request.

14. Your duties as a Data Principal

Section 15 of the DPDP Act also places some duties on you. In short: comply with applicable law when exercising your rights; do not impersonate another person when giving us personal data; do not suppress material information when giving us data that a law requires; do not register a false or frivolous grievance or complaint; and give us only information that is authentic when asking us to correct or erase data. The Act allows the Data Protection Board to impose a penalty of up to ₹10,000 for a breach of these duties.

Giving us accurate details is not just a legal duty — wrong identity, age, weight, pregnancy status, implant history or allergy information can directly affect the safety of a scan or a radionuclide therapy.

15. Consent Managers

The DPDP Act allows you to give, manage, review and withdraw your consent through a Consent Manager — an entity registered with the Data Protection Board of India that acts as a single, accessible point of contact for consent, and that is accountable to you.

We are not currently integrated with any Consent Manager. For now, please give, change or withdraw consent directly with us, using the routes in section 13.6. If this changes, we will update this notice.

16. Our website, booking forms and cookies

Our website at infinitymedicalcentre.com is built on WordPress. When you use it:

●      Enquiry and appointment forms: what you enter is sent to us and handled as described in this notice. Please do not enter detailed clinical information into a web form.

●      Essential cookies: the site and its forms set cookies that are necessary for the pages and form submissions to work.

●      Embedded third-party content: our contact pages embed Google Maps, and our booking page uses a third-party booking widget. These providers may set their own cookies and receive your IP address when the content loads.

●      Links out: where we link to another organisation’s website, this notice does not apply to it.

17. Grievance Officer and how to complain

If you have a question or a complaint about how we handle your personal data, or about a response we have given to a rights request, please contact our Grievance Officer. This is the person responsible under section 8(10) of the DPDP Act for answering your questions and resolving your grievances.

Name

MR. MOIZ KANCHWALA

Designation

CENTRE HEAD

Email

infinitymedicalcentremumbai@gmail.com

Telephone

022 6917 2424

Postal address

Citi Tower, Next to Gandhi Hospital, Dr. SS Rao Road, Parel, Along Raj Kamal Marg, Mumbai, Maharashtra 400012, India.

Hours

7:30 AM – 9:30 PM

Please tell us your name, your mobile number, which centre you attended, and what has gone wrong. We will acknowledge your grievance and respond within 30 days.

17A. Languages

Under section 5(3) of the DPDP Act you may ask to receive this notice in English or in any language listed in the Eighth Schedule to the Constitution of India. To request this notice in Marathi or Hindi, contact our Grievance Officer using the details in section 17 and we will provide it.

18. Changes to this notice

We may update this notice as our services, our systems or the law change — including as the rules under the DPDP Act come progressively into force. The version published on this page is always the current one, and the “Last updated” date at the top tells you when it changed. Where a change materially affects how we use your data, we will bring it to your attention.

19. Contact us

IMC 1 — Parel (Diagnostic Divisions)

Next to Gandhi Hospital (MGM), Dr. S. S. Rao Road, Parel (E), Mumbai – 4000012
Telephone: 022 6917 2424  |  Mobile: 86868 60745
Email: info@infinitymedicalcentre.co.in

IMC 2 — Sewri (Theragnostics Divisions)

Next to T. B. Hospital Main Gate, Koch’s House, Jerbai Wadia Road, Sewri, Mumbai – 400 015
Telephone: 022 6917 2400  |  Mobile: 80921 21212
Email: infopet@infinitymedicalcentre.co.in

This notice is published in English. If you would prefer it explained to you in Marathi or Hindi, please ask at the reception of either centre and a member of our staff will help you.