Privacy Policy

1. Responsible institution and contact

WIINS OT is intended for institutional use by the Western India Institute of Neurosciences (WIINS). Before this policy is published, WIINS must confirm its full legal-entity name, data-protection responsibilities, approved privacy contact and grievance mechanism.

Approved privacy contact: [To be designated by WIINS before publication].

2. What information may be processed

• Google account identity: when staff use Google Sign-In, identity information made available for authentication, such as an account identifier, email address, name and profile image when supplied.
• Staff and access records: user profiles, institutional affiliation, assigned roles, activity relevant to authorisation, sign-in sessions and audit records.
• Clinical and operative records: patient identity or UHID, demographics, diagnoses, planned procedures, theatre assignments, perioperative events, clinical documentation, follow-up and research variables entered by authorised users.
• Technical information: authentication/session cookies and service logs necessary for the application to function, troubleshoot issues and maintain security.

3. Why this information is used

Information supports staff authentication, role-based access, operating-theatre coordination, clinical documentation, accountability and auditability, and institutionally approved registry or research workflows. Google profile data is used to establish the signing-in staff member's identity; Google Sign-In does not itself grant clinical access.

Actual clinical-data processing must be supported by the institution's applicable notices, approvals and lawful basis. Research use and identifiable exports must follow approved hospital governance.

4. Who can access or receive information

Clinical information is intended to be accessible only to appropriately authorised personnel through institution- and role-based application controls. Technical infrastructure providers used for authentication, application hosting and database hosting may process information to provide those services, subject to the relevant arrangements. Disclosures may also occur where required by applicable law or authorised hospital processes.

Before publication, WIINS must confirm the complete list of relevant service providers, data processing terms, data locations and any applicable cross-border transfers. The application is not designed as an advertising or public patient-record sharing service.

5. Security

The current design uses authenticated sessions, institution-scoped access checks, database row-level security and auditable changes for clinical workflows. No electronic system is risk-free. WIINS must verify operational safeguards, access administration, backups, incident response and provider arrangements before clinical rollout.

6. Retention, correction and deletion

Records should be retained or disposed of according to WIINS-approved schedules, medical-record and research obligations, and applicable law. Those specific periods are [to be confirmed before publication]. Rights to access, correction, withdrawal where applicable, or deletion are subject to legal and professional record-keeping obligations and the hospital's verified request process.

7. Children and patient information

Staff may record information about patients of different ages only as part of authorised institutional care or research. The app is not intended for independent use by children or patients. WIINS must confirm any additional child-data safeguards required by applicable law and hospital policy.

8. Cookies and changes

Functional authentication cookies are used to maintain secure sign-in sessions. WIINS must review whether additional analytics or diagnostic services are enabled before publishing a final cookie disclosure. Any substantive changes to the approved policy should be reflected on this page with a new effective date.