Privacy Policy

1. Identity of the Data Fiduciary

InsightRx is a research practice of Synapse Healthcare Consultants Pvt. Ltd., a company incorporated under the Companies Act 2013, with its registered office at Gurgaon, Haryana – 122001, India ("InsightRx", "we", "us", or "our").

This Privacy Policy governs the collection, use, storage, disclosure, and protection of personal data obtained through our website at insightrx.in (the "Site") and through our research and consulting services. It is issued in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

By using the Site or engaging our services, you acknowledge that you have read and understood this policy. If you do not agree, please discontinue use of the Site.

2. Personal Data We Collect

We collect personal data in the following categories:

We do not knowingly collect personal data from individuals under 18 years of age. If you believe we have inadvertently collected such data, contact us immediately at [email protected].

3. Lawful Basis and Purposes of Processing

We process personal data only where a lawful basis exists under the DPDP Act 2023:

• Consent: When you submit a contact form, download a report, or participate in a research study, you provide free, specific, informed, and unambiguous consent for us to process your data for the stated purpose.
• Legitimate uses: Processing necessary to respond to your enquiry, fulfil a research engagement, comply with a legal obligation, or protect vital interests.
• Contractual necessity: Where you have entered into a research services agreement with us, processing is necessary to perform that contract.

Specific purposes include:

• Responding to enquiries and scoping research engagements
• Delivering commissioned research reports and deliverables
• Sending research proposals, project updates, and relevant sector communications
• Conducting primary fieldwork (interviews, surveys, focus groups) for client-commissioned studies
• Operating, maintaining, and improving the Site
• Complying with applicable law and regulatory obligations
• Preventing fraud and ensuring the security of our systems

4. Research Respondent Data — Special Obligations

InsightRx conducts primary research with healthcare professionals (physicians, hospital administrators, pharmacists, etc.) and, where applicable, patients and caregivers. The following additional obligations apply to respondent data:

• Confidentiality: Respondent identities are never disclosed to clients. All deliverables present aggregated or anonymised findings unless the respondent has given explicit written consent to be identified.
• Purpose limitation: Data collected during fieldwork is used solely for the commissioned study and is not repurposed without fresh consent.
• Sensitive personal data: Health-related information shared by respondents is treated as sensitive personal data under the IT (SPDI) Rules 2011 and is subject to heightened security and access controls.
• Retention: Raw respondent data (recordings, transcripts, survey responses) is retained for a maximum of 24 months from project completion, after which it is securely deleted or anonymised.
• Withdrawal: Respondents may withdraw consent and request deletion of their data at any time by contacting [email protected]. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

5. Disclosure of Personal Data

We do not sell, rent, or trade your personal data. We may share data in the following limited circumstances:

• Service providers: Third-party vendors who assist us in operating the Site or delivering services (e.g., cloud hosting, email delivery, analytics) — bound by data processing agreements and prohibited from using your data for their own purposes.
• Legal obligation: Where required by law, court order, or a competent regulatory authority in India.
• Business transfer: In the event of a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, subject to equivalent privacy protections.
• Protection of rights: Where necessary to protect the rights, property, or safety of InsightRx, our clients, or the public.

All third-party processors are required to maintain confidentiality and implement security measures consistent with this policy and applicable law.

6. Cross-Border Data Transfers

Our primary data processing infrastructure is located in India. Where data is transferred outside India (for example, to cloud service providers with servers in other jurisdictions), we ensure that such transfers comply with the DPDP Act 2023 and any applicable government notifications regarding permitted countries. We implement appropriate contractual safeguards for all cross-border transfers.

7. Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by law:

• Enquiry and contact data: Up to 36 months from last contact, unless an engagement is initiated.
• Client engagement data: 7 years from project completion, in line with standard Indian accounting and contractual record-keeping requirements.
• Research respondent data: 24 months from project completion (see Section 4).
• Website usage data: Up to 26 months in analytics systems.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised.

8. Data Security

We implement reasonable security practices and procedures as required under Rule 8 of the IT (SPDI) Rules 2011, including:

• Encryption of data in transit (TLS/HTTPS) and at rest where applicable
• Access controls limiting data access to authorised personnel on a need-to-know basis
• Regular review of security practices and third-party processor compliance
• Incident response procedures for personal data breaches

In the event of a personal data breach that is likely to result in harm to data principals, we will notify affected individuals and, where required, the Data Protection Board of India, in accordance with the DPDP Act 2023.

9. Cookies and Tracking Technologies

The Site uses cookies and similar technologies for analytics and performance measurement. Cookies do not contain personally identifiable information on their own. You may control or disable cookies through your browser settings; doing so will not affect your ability to access the Site, though some features may function differently.

We do not use tracking technologies for behavioural advertising or cross-site tracking. Where we use third-party analytics tools, they are configured to anonymise IP addresses where technically feasible.

10. Your Rights as a Data Principal

Under the DPDP Act 2023, you have the following rights in respect of your personal data:

• Right to access: Obtain a summary of the personal data we hold about you and the purposes for which it is processed.
• Right to correction and erasure: Request correction of inaccurate or incomplete data, or erasure of data that is no longer necessary for the purpose for which it was collected.
• Right to grievance redressal: Have your grievances addressed in a timely manner. If you are not satisfied with our response, you may approach the Data Protection Board of India.
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of prior processing.
• Right to nominate: Nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, submit a written request to [email protected]. We will respond within 30 days. We may need to verify your identity before processing your request.

11. Links to Third-Party Websites

The Site may contain links to external websites. We are not responsible for the privacy practices or content of those sites. We encourage you to review the privacy policies of any third-party sites you visit.

12. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in law, our practices, or our services. The "Last updated" date at the top of this page reflects the most recent revision. Where changes are material, we will post a prominent notice on the Site. Continued use of the Site after the effective date of a revised policy constitutes your acceptance of the changes.

13. Grievance Officer

In accordance with the Information Technology Act 2000 and the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, the details of our Grievance Officer are:

14. Governing Law and Jurisdiction

This Privacy Policy is governed by the laws of India. Any disputes arising under or in connection with this policy shall be subject to the exclusive jurisdiction of the courts at Gurgaon, Haryana, India.