Legal

Privacy Policy

Last updated: 20 August 2026

1. Who We Are

Quaid-e-Millath Centre for Humanity ("QMCH", "we", "us", "our") is a charitable organisation registered under the Societies Registration Act, providing free home-based palliative care, physiotherapy and community support services in Chennai, Tamil Nadu.

This policy explains what personal information we collect through our website at qmch.org, why we collect it, how we protect it, and what rights you have over it. For the purposes of the Digital Personal Data Protection Act, 2023, QMCH acts as a Data Fiduciary in respect of the personal data described below.

By using this website or submitting any form on it, you agree to the practices described in this policy.

2. Information We Collect

Donor information

When you make a donation, we collect your name, email address, telephone number, donation amount, and details of what your donation is directed towards. Where you request an 80G tax exemption receipt, we may also collect your postal address and PAN.

Patient and beneficiary information

When a patient is registered for our services — whether by the patient, a family member, a caregiver or a referring party — we collect the patient's name, gender, date of birth, medical condition, residential address, and the name and contact details of an accompanying person or bystander.

Volunteer and enquiry information

If you contact us, apply to volunteer, or enquire about partnership, we collect the contact details and background information you choose to provide.

Information collected automatically

Like most websites, we automatically receive certain technical information when you visit — your IP address, browser type, device type, pages viewed, and the time and duration of your visit. This is used in aggregate to understand how the site is used and to keep it secure.

3. How We Use Information

We use the information we collect only for the purposes for which it was given:

• To deliver care. Patient information is used to assess eligibility, plan and provide medical, nursing, physiotherapy and support services, and maintain clinical records.
• To process donations. Donor information is used to complete the transaction, issue receipts including 80G certificates where applicable, and maintain the financial records we are required by law to keep.
• To communicate with you. To respond to enquiries, acknowledge donations, and — where you have asked to hear from us — send updates about our work.
• To meet legal obligations. To comply with the Income Tax Act, the Societies Registration Act, audit requirements, and any lawful request from a government authority.
• To report on our work. To prepare statistical and impact reports. Information used in this way is aggregated and anonymised — no individual patient is identifiable.

We do not sell, rent or trade personal information to anyone, for any purpose.

4. Consent and Legal Basis

We process personal data on the basis of the consent you give when you submit a form, and, where applicable, for the legitimate uses permitted under the Digital Personal Data Protection Act, 2023 — including compliance with legal obligations and the provision of medical treatment or health services.

Where a form is completed on behalf of a patient by a family member, caregiver or other representative, that person confirms they are authorised to provide the patient's information and to consent on the patient's behalf.

You may withdraw your consent at any time by contacting us using the details at the end of this policy. Withdrawal will not affect anything done before it, and may mean we can no longer provide certain services.

5. Payment Information

Online donations are processed by Razorpay Software Private Limited, a payment gateway regulated by the Reserve Bank of India.

QMCH does not collect, see or store your card number, CVV, UPI PIN, net banking credentials or any other payment credential. These are entered directly on Razorpay's secure infrastructure and are governed by Razorpay's own privacy policy and its PCI DSS obligations.

What we receive back from Razorpay is limited to confirmation of the transaction: the amount, the date, a transaction reference, and the payment method used. This is what we need to acknowledge your gift and maintain accurate accounts.

6. Sharing and Disclosure

We share personal information only in the following circumstances:

• Clinical partners. Where a patient requires treatment we cannot provide directly — such as dialysis or specialist consultation — we share the clinical information necessary for that referral with the treating institution.
• Service providers. Our payment gateway, website host, and email service providers process data on our behalf, under obligations of confidentiality and only as needed to provide their service.
• Auditors and regulators. Our independent auditors and, where legally required, the Income Tax Department or other authorities may access records containing personal data.
• Where the law requires it. We will disclose information where compelled by a court order, statutory notice or other binding legal process.

We do not share patient information with donors, and we do not identify individual patients in fundraising material, on this website, or on social media without separate, specific written consent.

7. Data Retention

We keep personal data only as long as it is needed for the purpose it was collected, or as long as the law requires — whichever is longer.

• Donation and financial records are retained for the period required under the Income Tax Act and applicable audit rules.
• Patient records are retained for as long as necessary for continuity of care and to meet clinical record-keeping obligations.
• Enquiry and volunteer records are retained only while relevant to the enquiry or engagement.

When data is no longer required, it is securely deleted or anonymised.

8. Data Security

We take reasonable technical and organisational measures to protect personal information against unauthorised access, disclosure, alteration or destruction. These include encrypted transmission of data submitted through this website, restricted access to records on a need-to-know basis, and the use of reputable, regulated service providers for payment processing and hosting.

No system is completely secure, and we cannot guarantee absolute security. If a breach occurs that is likely to affect you, we will notify you and the relevant authority as required by law.

9. Your Rights

Under the Digital Personal Data Protection Act, 2023, you have the right to:

• Access a summary of the personal data we hold about you and how it is processed.
• Correct data that is inaccurate, and complete data that is incomplete.
• Erase personal data where it is no longer needed for the purpose it was collected and no legal obligation requires us to keep it.
• Nominate another person to exercise these rights on your behalf in the event of your death or incapacity.
• Raise a grievance about how your data has been handled.

To exercise any of these rights, contact our Grievance Officer using the details below. We will respond within the timeframe prescribed by law. We may need to verify your identity before acting on a request.

10. Cookies and Analytics

This website uses cookies — small files stored on your device — to keep the site working properly, remember your preferences, and understand how visitors use it.

We may use third-party services including Google Analytics and Google reCAPTCHA. These providers may set their own cookies and receive technical information about your visit, governed by their own privacy policies. reCAPTCHA is used solely to protect our forms against automated abuse.

You can block or delete cookies through your browser settings. Some parts of the site may not work correctly if you do.

11. Children's Information

We do not knowingly collect personal information directly from children under 18 through this website. Where a child is registered as a patient, their information is provided by a parent, legal guardian or authorised caregiver, who consents on the child's behalf. Children's data is processed with the additional protections required under the Digital Personal Data Protection Act, 2023, and is never used for tracking, behavioural monitoring or targeted advertising.

12. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or in the law. The revised version will be posted here with an updated date. Where changes are significant, we will take reasonable steps to bring them to your attention. Continued use of the website after a change takes effect constitutes acceptance of the revised policy.