1. Introduction & Scope
i-Services Alliance Solutions Pvt Ltd (“i-Services”, “Company”, “we”, “our”, or “us”), incorporated under the laws of India and operating from #112, 12th Cross, Girinagar 3rd Phase, Bangalore – 560 085, Karnataka, India, operates specialized healthcare Revenue Cycle Management (RCM), insurance desk outsourcing, TPA empanelment, cashless pre-authorization, claim filing, and reconciliation services for hospitals, clinics, nursing homes, and diagnostic centres across India.
This Privacy Policy sets out how we collect, store, handle, process, transfer, and safeguard personal data, sensitive personal data or information (SPDI), institutional business credentials, and patient health insurance claim documentation received through our website (https://www.i-services.co.in), our proprietary operations portals, email exchanges, WhatsApp business channels, and dedicated on-site hospital desks.
Institutional Trust Commitment
We recognize that healthcare records and claim filings contain delicate financial, identity, and clinical health details. We handle all data in strict compliance with the Digital Personal Data Protection Act (DPDP Act, 2023), the Information Technology Act, 2000, the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and guidelines issued by the Insurance Regulatory and Development Authority of India (IRDAI) and the National Health Authority (NHA).
2. Information We Collect
Depending on the nature of your interaction with i-Services Alliance Solutions, we collect and process the following categories of data:
| Category | Data Elements Collected | Collection Channel |
|---|---|---|
| Hospital / Client Credentials | Hospital legal entity name, address, licensing numbers, ROHINI/NABH accreditation IDs, authorized executive contacts, billing tariffs, and bank account details for claim remittance reconciliation. | Contracting agreements, client onboarding forms, official email correspondence. |
| Patient Demographic & Identity Data | Patient full name, age, date of birth, gender, address, phone number, relationship to primary policyholder, government-issued photo identification (where mandated by insurers/TPAs). | Received from client hospitals' admission desks, patient counselling workflows, or pre-auth forms. |
| Insurance & TPA Policy Information | Insurance company name, Third-Party Administrator (TPA) name, policy number, member ID, corporate policy employee number, government scheme cards (CGHS, ECHS, PMJAY, GIPSA network). | Insurance e-cards, physical cards, and digital verification requests submitted during admission. |
| Clinical, Diagnostic & Billing Records | Treating consultant notes, provisional and final diagnosis, ICD-10 medical coding, discharge summaries, laboratory & radiology reports, surgical/ICU notes, and itemized hospital pharmacy bills. | Uploaded by hospital medical records departments (MRD) or collected on-site for claim dossier preparation. |
| Website & Inquiry Data | Name, business email, organization, contact phone number, facility type, consultation inquiries, interactive claim tracker demo queries, IP address, browser type, and referrer URL. | Contact Us forms, Claim Tracker input, chatbot interactions, web analytics cookies. |
3. Purpose of Data Processing
i-Services Alliance Solutions processes collected data exclusively for bona fide, legitimate business and operational healthcare purposes, including:
-
Cashless Pre-Authorization & Approvals: Preparing, auditing, and transmitting initial pre-authorization requests, enhancement queries, and final discharge authorizations to TPAs and insurers within stringent hospital turnaround times.
-
Claim Docket Audit & Physical/Digital Submission: Assembling complete, audited claim dockets adhering strictly to insurer checklists, preventing claim rejections and technical repudiations.
-
Payment Reconciliation & Dispute Recovery: Cross-referencing bank settlement advice (UTR numbers) against hospital indoor patient bills, tracking disallowed deductions, and filing appeals for recovery.
-
Hospital Network Empanelment: Compiling hospital infrastructure, doctor credentialing, and tariff schedules for GIPSA, private TPAs, and PSU insurance empanelment.
-
Customer Service & Inquiry Management: Addressing incoming inquiries, providing free hospital RCM revenue leakage audits, and servicing demo claim inquiries.
-
Legal & Regulatory Compliance: Fulfilling accounting, tax, auditor requirements, and statutory record-keeping under Indian jurisprudence.
4. Legal Basis & Processing Roles
Under the Digital Personal Data Protection Act, 2023 (DPDP Act):
-
Data Processor on Behalf of Healthcare Providers: When i-Services Alliance Solutions processes patient medical records and claim files, the client hospital or healthcare facility serves as the Data Fiduciary (responsible for obtaining valid patient consent at admission), and i-Services operates as a specialized Data Processor bound by institutional Business Associate Agreements (BAA) and Non-Disclosure Agreements (NDAs).
-
Data Fiduciary for Website Inquiries: In respect of inquiries submitted through our website contact forms, demo tracker, or job applicants, i-Services acts as a Data Fiduciary relying on express voluntary consent provided at the time of submission.
Patient Consent Verification
Patient health records are submitted to us by partner hospitals who confirm that appropriate consent for treatment, cashless facilitation, and insurance claims filing has been executed by the patient or their legal guardian during the hospital admission process.
5. Data Sharing & Third-Party TPAs
We enforce a strict Zero Sale of Data policy. We do not sell, rent, barter, trade, or monetize personal or health records to any commercial data brokers, advertising agencies, or marketing third parties.
Data is disclosed strictly on a need-to-know operational basis only to the following entities:
-
Licensed Insurers & Third-Party Administrators (TPAs): Legitimate IRDAI-registered insurance companies (e.g., Star Health, HDFC ERGO, ICICI Lombard, New India Assurance) and licensed TPAs (e.g., Medi Assist, Vidal Health, Health India, Paramount TPA, MDIndia) evaluating the patient’s cashless authorization or reimbursement claim.
-
Client Hospitals & Treating Clinicians: The empanelled hospital where the patient is receiving treatment to facilitate transparent billing, query responses, and settlement.
-
Secure Technology Infrastructure Providers: Encrypted cloud hosting partners and certified SMS/WhatsApp notification gateways operating under strict data processing agreements and ISO/IEC 27001 standards.
-
Statutory & Law Enforcement Authorities: When formally compelled by applicable Indian law, court order, or judicial decree from a competent legal authority.
6. Data Security, Access Control & Retention
i-Services Alliance Solutions implements comprehensive administrative, physical, and technical safeguards engineered to prevent unauthorized access, loss, alteration, or disclosure:
-
End-to-End Encryption: All digital data transfers between hospitals, our centralized operations hub, and TPA portals are encrypted using Transport Layer Security (TLS 1.3 / HTTPS). Stored databases utilize industry-standard AES-256 encryption.
-
Role-Based Access Control (RBAC): Access to sensitive patient dockets is restricted exclusively to designated claim executives handling that specific hospital account. Multi-factor authentication (MFA) is strictly enforced.
-
Comprehensive Audit Trails: Every document upload, view, edit, download, and transmission is logged with immutable timestamped audit trails.
-
Strict Confidentiality Agreements: Every employee, medical coder, claim auditor, and operations specialist at i-Services executes legally binding confidentiality agreements and undergoes periodic healthcare data privacy training.
Data Retention Schedules
We retain claim files and financial settlement archives strictly for the period mandated by hospital client agreements, IRDAI claims audit guidelines, and statutory limitation periods under the Limitation Act, 1963 (customarily 3 to 7 years from final settlement), after which electronic records are securely expunged and sanitized.
7. Data Principal Rights
Under the Digital Personal Data Protection Act, 2023, individuals (Data Principals) whose personal data is processed have specific statutory rights:
-
Right to Access & Summary: The right to request confirmation on whether personal data is being processed, along with a summary of the data and processing activities.
-
Right to Correction & Erasure: The right to request rectification of inaccurate or outdated information, or completion of incomplete claim documentation.
-
Right to Grievance Redressal: The right to access an effective grievance resolution mechanism regarding any failure in data handling.
-
Right to Nominate: The right to nominate an individual who shall exercise data rights in the event of death or incapacity.
*Note: Where i-Services processes patient data as a Data Processor on behalf of a client hospital, requests for record modification or deletion must be routed through the primary healthcare provider that admitted the patient to ensure medical audit compliance.
8. Cookies & Digital Tracking
Our website uses minimal, essential cookies and browser storage tokens necessary for website security, page responsiveness, and session continuity.
-
Essential Cookies: Required to enable standard web navigation, CSRF protection, and responsive display across desktop and mobile devices.
-
Analytics (Aggregated): Anonymized telemetry to monitor page load performance, visitor counts, and high-interest healthcare articles without collecting identifiable personal health data.
You can adjust or disable cookie permissions at any time via your browser settings. Disabling essential cookies will not restrict your access to core website information.
9. Grievance Redressal & Data Protection Officer
In accordance with Rule 5(9) of the Information Technology (SPDI) Rules, 2011, and the Digital Personal Data Protection Act, 2023, the details of the designated Grievance Officer for i-Services Alliance Solutions Pvt Ltd are provided below:
Data Protection & Grievance Officer
For any privacy inquiries, data subject access requests, or grievance submissions, please reach out to our designated officer:
We acknowledge all data-related grievances within forty-eight (48) hours of receipt and endeavor to resolve complaints within thirty (30) business days.
10. Updates to This Privacy Policy
We may periodically review and update this Privacy Policy to reflect evolving regulatory frameworks, statutory amendments under Indian law, or enhancements to our healthcare RCM technology stack.
When modifications are enacted, the updated policy will be published on this page with an updated "Effective Date". We encourage hospitals and visitors to review this page periodically to remain informed on our data protection standards.