PRIVACY NOTICE
1. INTRODUCTION
Mindray Medical India Private Limited (“Mindray India”, “Company”, “we”, “us” or “our”) is committed to protect the privacy and security of Personal Data of an individual, entrusted to us. This Privacy Notice sets out the manner in which Mindray India collects, receives, uses, processes, discloses, transfers, stores, retains, secures and otherwise handles Personal Data in the course of its business and activities.
Mindray India is engaged in the manufacture, marketing, sale, distribution, installation, servicing and support of medical devices and related healthcare products and services and forms part of the global Mindray Group, China.
We deeply value the trust reposed in us by our customers, patients, healthcare professionals, employees, prospective employees, dealers, distributors, vendors, suppliers, consultants, contractors, business partners, and all other individuals whose Personal Data we process. Safeguarding such Personal Data and upholding the rights of each individual (“you” or “your”) forms an integral part of our commitment as a responsible organisation and as a subsidiary of the global Mindray Group.
2. SCOPE
This Privacy Notice applies to Personal Data collected and processed in connection with our website portal, and other digital platforms (“Applications”), enquiries, contact forms, product enquiries, demonstrations and requests for information, purchase, sale, supply, delivery, installation, commissioning, warranty and after sales services, maintenance, repair, servicing, technical support, product complaints and recalls, customer and healthcare professional relationship management, dealers, distributors, vendors, suppliers, consultants and other business partners, business communications and professional engagements, recruitment, employment, human resources and workforce administration, events, seminars, conferences, training and promotional activities, financing, insurance, claims and payment related activities, CCTV and physical security installed at our offices, factories, warehouses and other premises, and any other lawful business activity involving the processing of Personal Data.
This Privacy Notice may apply to individuals located in India and, where applicable, individuals outside India whose Personal Data is processed in connection with Mindray India’s activities.
3. PERSONAL DATA WE COLLECT
Depending upon your relationship with Mindray India and the relevant products, services or activities, we may process the following categories of Personal Data:
3.1. Identity and Contact Information: Name, title, date of birth where required, residential, correspondence, office or business address, email address, telephone/mobile number, photograph, signature and government issued identification information (where ever necessary) including PAN, Aadhaar or driving licence, where lawfully required.
3.2. Professional and Employment Information: Organisation, designation, employment status and history, educational qualifications, professional memberships and certifications, skills, experience, references, CV/resume, interview and assessment information, remuneration and benefits information, and other information necessary for recruitment or employment.
3.3. Financial Information: Bank account and payment details, billing information, invoices, purchase orders, financing and insurance information, payment status, claims, warranty records and transaction history, where necessary for the relevant transaction or business relationship.
3.4. Health and Medical Information: Depending on the nature of our products, services, employment activities or regulatory obligations, we may process medical records and history, information concerning medical devices or their use, patient or user conditions where necessary for product safety or support, adverse event and product complaint information, medical device vigilance and regulatory information, and health information lawfully provided in connection with employment, insurance, services or other activities.
3.5. Product, Equipment and Usage Information: Equipment and device serial numbers, product identification, installation and commissioning records, service and maintenance records, warranty information, diagnostics, operational data, operating hours, fault/error information, product usage information, complaints, adverse events, recalls and safety notices.
3.6. Technical and Online Information: IP address, browser and device type, operating system, device identifiers, approximate location derived from technical information where applicable, cookies and similar technologies, access logs, pages visited, referring pages, session and interaction data, crash and diagnostic information and other technical information necessary to operate, maintain and secure our websites and Applications.
3.7. CCTV and Physical Security Information: CCTV images and related information collected at our offices, factories, warehouses and other premises for security, safety, access control, incident investigation and protection of persons and property.
3.8. Recruitment and Employee Information: Information relating to applicants and employees, including identification, educational and professional qualifications, employment history, applications, references, interviews, assessments, compensation, benefits, attendance, leave, bank and tax details, statutory employment information, emergency contacts and other information necessary for employment administration and compliance.
3.9. Information received from Third Parties: We may receive Personal Data from dealers, distributors, customers, healthcare institutions, vendors, service providers, recruitment agencies, business partners, insurance companies, financial institutions, regulators, government authorities, publicly available sources, professional or business platforms and social media platforms where you interact with us, and other persons or organisations lawfully authorised to provide such information. Where Personal Data is provided by a third party, Mindray India expects that such party has the necessary authority and lawful basis to provide the information.
4. PURPOSES OF PROCESSING
We may process Personal Data for processing enquiries, orders and applications and providing products and services, installation, commissioning, warranty, maintenance, repair, servicing and technical support, processing payments, invoices, financing and insurance matters, managing customer, healthcare professional, dealer, distributor and business relationships, addressing product complaints, quality, safety, adverse events, recalls, vigilance and regulatory requirements, analysing equipment and operational data and conducting research, testing and product/service development, operating, securing, analysing and improving websites and Applications, managing proposals, contracts, meetings, demonstrations and commercial relationships, sending newsletters, event and training information and marketing communications where permitted by law and, where required, based on consent, recruitment, background verification, employment administration, payroll, benefits, performance, training, workplace security and statutory compliance, protecting our systems, networks, premises, persons and property and preventing fraud, misuse and unauthorised activity, investigating incidents, resolving disputes and enforcing applicable terms and policies, complying with applicable laws, regulations, court orders, judgments and lawful governmental or regulatory directions, fulfilling tax, accounting, employment, corporate and medical device regulatory obligations, establishing, exercising or defending legal claims, and responding to medical emergencies, providing health services or treatment, protecting life or safety, responding to disasters or breakdowns of public order, and undertaking other processing permitted by applicable law.
5. LAWFUL BASIS AND LEGITIMATE USES
We shall process Personal Data only for a lawful purpose and in accordance with applicable law, including the Digital Personal Data Protection Act, 2023 (“DPDP Act”). Depending on the circumstances, processing may be undertaken on the basis of consent or a specified legitimate use recognised under applicable law. Such legitimate uses may include voluntary provision of Personal Data for a specified purpose, performance of functions or provision of services under law, compliance with legal obligations, judgments, decrees or orders, medical emergencies, medical treatment and health services, disasters or breakdowns of public order, employment related purposes and safeguarding the employer's interests where permitted by law, prevention, detection, investigation or prosecution of offences or contraventions, compliance with requirements of government, regulators or statutory authorities, and other legitimate uses expressly recognised by applicable law.
6. DATA MINIMISATION AND PURPOSE LIMITATION
We seek to collect and process only such Personal Data as is reasonably necessary and relevant for the purpose for which it is processed. We do not ordinarily collect Personal Data merely because it may be useful for a potential future purpose.
7. SHARING AND DISCLOSURE
We may disclose or otherwise share Personal Data where necessary for the purposes described in this Privacy Notice, or as per the consent given by you, or otherwise permitted or required by applicable law. Personal Data may be shared with Mindray Group companies and affiliates, in India or other jurisdictions, for group-wide functions including reporting, analytics, compliance, fraud prevention, IT, cybersecurity, customer relationship management, employee and vendor management, and product and quality management, authorised dealers, distributors and employees, for delivery, installation, warranty, after-sales service, maintenance, spare-parts management, recalls, complaints and customer support, Data Processors and service providers, including IT, cloud hosting, data storage, cybersecurity, payment, financing, insurance, logistics, customer support, call centre, marketing, analytics, recruitment, payroll, HR, audit and professional service providers, government, regulatory and law-enforcement authorities, courts, tribunals, tax authorities, medical device regulators and other legally authorised recipients, auditors, lawyers, insurers, consultants, financial institutions, transaction advisers and other professional advisers or business partners, where reasonably necessary and parties involved in mergers, acquisitions, restructuring, sale, financing or similar corporate transactions, subject to appropriate confidentiality and data-protection safeguards.
8. CROSS BORDER TRANSFERS
Personal Data may be processed and shared in India or other countries through Mindray Group entities, cloud and technology providers, professional advisers or other service providers. Mindray India may transfer/share Personal Data outside India permitted by applicable law and shall comply with applicable restrictions, conditions or requirements prescribed by the Central Government. Appropriate contractual, organisational and technical safeguards will be implemented for international transfers, including confidentiality obligations, access controls and security measures proportionate to the nature and risks of the processing.
Where Personal Data is shared with Mindray Group entities outside India, including entities in China, appropriate intra group arrangements and safeguards will be implemented as required by applicable law.
9. DATA SECURITY
We maintain reasonable technical, organisational and administrative safeguards designed to protect Personal Data against unauthorised access, unlawful processing, accidental loss, destruction, alteration, disclosure, misuse and other reasonably foreseeable security risks. Depending on the nature and risks of processing, safeguards may include access controls, authentication and authorisation mechanisms, encryption, data masking, secure storage, network and endpoint security, logging and monitoring, backup and recovery, vulnerability management, incident response, employee training, confidentiality obligations, vendor due diligence and contractual data-protection requirements. Mindray India may adopt recognised information security standards, including ISO/IEC 27001 or equivalent standards, where appropriate.
10. PERSONAL DATA BREACH
Mindray India maintains procedures for identifying, assessing, responding to and managing Personal Data breaches. In the event of a breach, we will take reasonable and appropriate measures to contain and investigate the incident, assess its impact, mitigate potential harm, restore affected systems, maintain appropriate records, notify affected individual where required, notify the Data Protection Board of India or other competent authorities where required, and implement corrective and preventive measures. All notifications will be made in accordance with applicable legal requirements and prescribed timelines.
11. CHILDREN AND PERSONS WITH DISABILITIES
Mindray India will obtain verifiable consent from the parent or lawful guardian, as required by law, before processing Personal Data of a Child (who has not completed eighteen years of age) or a person with disability whose lawful guardian is legally authorised to act on their behalf.
12. RIGHTS OF INDIVIDUAL / DATA PRINCIPAL
Subject to applicable law and any lawful restrictions, an individual/Data Principal may have the following rights:
12.1. Right to access information: to obtain information concerning their Personal Data and its processing, including a summary of Personal Data processed and information concerning recipients, where required by law.
12.2. Right to correction and erasure/ withdraw: to request correction of inaccurate, incomplete or outdated Personal Data and erasure / withdraw wherever permitted by law.
12.3. Right to grievance redressal: to raise grievances concerning processing of Personal Data or the exercise of privacy rights.
12.4. Right to nominate: to nominate another individual to exercise applicable rights in the event of death or incapacity and to modify or withdraw such nomination in accordance with law.
Mindray India may retain Personal Data despite an erasure request where retention is necessary or required for legal or regulatory compliance, contractual obligations, legal claims, dispute resolution, fraud prevention, product safety, medical device vigilance, accounting, taxation or other lawful purposes.
13. DATA RETENTION
We retain Personal Data only for as long as reasonably necessary for the purpose for which it was collected or processed, or as required or permitted by applicable law. Retention periods may depend upon the nature of the relationship, purpose of processing, contractual requirements, statutory and regulatory obligations, medical device requirements, legal / tax and accounting requirements/ compliance, limitation periods, dispute resolution, product safety and recall requirements, legitimate business requirements and applicable consent. Different categories of Personal Data may therefore be retained for different periods.
14. GRIEVANCE REDRESSAL
For questions, requests or grievances concerning the processing of Personal Data, please contact:
Grievance Officer (Privacy)
Mindray Medical India Private Limited
Address: Bldg # 9B, 16th Floor, DLF Phase -III, Gurugram, Haryana - 122002
Email: dataprotection.grievance@mindray.com
The Grievance Officer may be contacted in relation to privacy queries, access requests, correction or erasure requests, withdrawal of consent, nomination related matters, complaints concerning processing, Personal Data breach concerns and other privacy related matters. We shall endeavour to address grievances within the period prescribed under applicable law.
Mindray India may amend this Privacy Notice from time to time to reflect changes in its business or processing activities, technology, applicable laws or regulations, regulatory requirements, security practices or other developments relating to privacy and data protection.