Data Protection & Privacy Policy

Privacy Policy & Data Security

Guided by international healthcare data governance principles and patient confidentiality best practices.

1. Overview & Scope

ANNESHA HOSPITAL AND DIAGNOSTIC ("Onnesha HMS") describes through this policy our technical safeguards and procedural controls for handling patient demographic data, outpatient consultation records, diagnostic appointments, and billing transactions. Legal compliance should be assessed against applicable Bangladesh law and current operational healthcare practices.

2. Technical & Organizational Safeguards

We implement the following technical safeguards across our patient care management platform:

Purpose Limitation: Information collected solely for patient identification, medical appointments, and hospital invoicing.
Data Minimization: Anonymous visitors to the public website have zero access to patient personal data. Public queue boards project only token numbers and room identifiers.
Transport Protection: Encrypted network transit enforced via HTTPS across all client endpoints.
Database Authorization: Granular multi-tenant Row Level Security (RLS) and search-path isolated procedures.

3. Patient Data Rights (ব্যক্তিগত উপাত্ত সুরক্ষা আইন, ২০২৬ / Personal Data Protection Act, 2026 — Act No. 63 of 2026)

In alignment with the statutory principles of the Bangladesh Personal Data Protection Act, 2026 (ব্যক্তিগত উপাত্ত সুরক্ষা আইন, ২০২৬ — Act No. 63 of 2026, deemed effective from 6 November 2025, with specified administrative provisions subject to gazetted commencement), registered patients are afforded the following defined healthcare information rights:

Right to Access (Section 11)

Request inspection of registered personal identification and historical consultation records held by the hospital.

Right to Rectification (Section 12)

Request correction or updating of inaccurate demographic details, phone numbers, or guardian particulars.

Consent Withdrawal (Section 13)

Withdraw consent for optional non-essential communications while ensuring active clinical treatment continuity.

System-Wide Propagation (Section 14)

Propagate patient record corrections and consent updates across all clinical, laboratory, and billing modules.

Security Obligations (Section 17)

Technical and operational measures applied to prevent unauthorized access, tampering, or loss of medical records.

Data Retention (Section 18)

Medical histories and billing journals retained strictly in accordance with national healthcare statutory retention mandates.

Incident Reporting (Section 20)

Established internal protocols for investigating, remediating, and reporting potential data security incidents.

4. Role-Based Access Controls & System Auditing

Clinical and financial data access is restricted to verified hospital personnel based on assigned duties (Doctors, Nurses, Pharmacists, Cashiers, and Reception Staff). Critical administrative operations and record modifications generate audit trail entries with user attribution and timestamps.

5. Privacy Inquiries & Patient Relations Contact

For any questions regarding personal data records, consent revocation, or privacy choices, please reach out to our hospital administration desk:

Privacy & Patient Relations Contact Desk — ANNESHA HOSPITAL AND DIAGNOSTIC

Email: aaih.apon@gmail.com

Telephone: 01895-665114, 01904210065

Physical Address: সোনালী ব্যাংকের সামনে, খান্দার, বগুড়া।

পেজ লোড হচ্ছে...