Privacy Notice & Consent Form

PART A — PRIVACY NOTICE UNDER SECTION 5 OF THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023

This Notice is issued by Apollo Hospitals Enterprise Limited (“Company” or “AHEL”), acting as Data Fiduciary, in connection with the issuance of e-coupons to eligible shareholders of the Company (“Scheme”). This Notice is given prior to seeking consent under Section 6 of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), and sets out the personal data proposed to be processed, the purpose of such processing, and the manner in which a shareholder may exercise the rights available under the DPDP Act. Under the Scheme, eligible shareholders will receive a communication containing a secure link. Through this link, and after authenticating their identity using their registered mobile number, a shareholder may download a pre-populated e-coupon booklet comprising twelve (12) coupons, each bearing a unique identification number. Each coupon may be redeemed once, for eligible healthcare services at Apollo Hospitals, Apollo Pharmacy outlets, and Apollo-operated clinics, within one (1) year from the date of issuance, subject to the applicable terms and conditions.

Personal data collected

For the purpose of the Scheme, the following categories of personal data are proposed to be collected and processed:
a. name and folio number / DP ID and Client ID, as available to the Company from its statutory shareholder records, including through its Registrar and Share Transfer Agent (“RTA”) and/or the relevant depository ;
b. registered mobile number, used for authentication of identity prior to download of the e-coupon;
c. the unique identification number generated for each e-coupon, together with associated redemption records (i.e., which coupon was used and when); and
d. the date and time of consent, the IP address from which such consent is provided, and the version of the Privacy Notice/Consent Form accepted by the shareholder, as recorded through the e-coupon portal for evidentiary purposes.

2. Purpose of Processing

The personal data referred to above will be processed for the following purposes only:
a. verifying eligibility as a shareholder entitled to an e-coupon booklet, based on the Register of Members of the Company;
b. authenticating identity through the registered mobile number, prior to allowing download of the e-coupon;
c. generating a pre-populated e-coupon booklet (comprising twelve coupons per shareholder), including assignment of a unique identification number to each coupon;
d. enabling the shareholder to present the e-coupon for redemption at Apollo Hospitals, Apollo Pharmacy outlets, and Apollo-operated clinics, and confirming, through the Company's internal systems, that each coupon is redeemed only once and within the one (1) year validity period;
e. responding to queries, complaints, or grievances relating to the Scheme;
f. compliance with applicable law and prevention of fraud or duplicate or unauthorised issuance; and
g. recording and maintaining evidence of the shareholder’s consent, including the date and time of consent, IP address, and the version of the Privacy Notice/Consent Form accepted.

3. Disclosure of Personal Data

For the purposes of the Scheme, personal data is processed only to the extent necessary for the purposes described in this Notice. Any processing of personal data by a service provider on behalf of the Company in connection with the Scheme will be subject to appropriate contractual and security safeguards.
The Company does not share shareholders' personal data with Apollo Hospitals, Apollo Pharmacy outlets, or Apollo-owned clinics. At the point of redemption, the shareholder presents the e-coupon directly to the redemption outlet; the e-coupon displays only the shareholder's name, folio number, the unique coupon identification number, and the applicable terms and conditions, and no other personal data of the shareholder is made available to, or shared with, any redemption outlet.
Personal data may otherwise be disclosed to a statutory, regulatory, or governmental authority where required by applicable law. Personal data is not sold, and is not used for any purpose other than as stated in this Notice, save as permitted or required by applicable law.

4. Retention

Personal data will be retained for the validity period of the e-coupon booklet (one (1) year as stipulated in the e-coupon), and for a further period not exceeding twelve (12) months thereafter for reconciliation and audit purposes, save that where a grievance is pending as on the expiry of such period, the relevant personal data will continue to be retained only until that grievance is resolved. Personal data will thereafter be deleted or anonymised, or retained only where continued retention is required under applicable law. For clarity, the foregoing retention period applies only to Scheme-specific records and does not affect the Company's separate retention of statutory shareholder records to the extent required under the Companies Act, 2013, applicable SEBI/depository requirements or other applicable law.

5. Rights of the Shareholder

Subject to the provisions of the DPDP Act, a shareholder has the right to obtain a summary of the personal data being processed (right to access); to seek correction, completion, updating, or erasure of personal data; to withdraw consent at any time, with such withdrawal being no more difficult than the giving of consent, without affecting the lawfulness of processing carried out prior to withdrawal; to nominate another individual to exercise these rights in the event of death or incapacity; and to have readily available means of registering a grievance. Where consent is withdrawn, or the registered mobile number required for authentication is not provided, the Company will not be in a position to issue or permit download of an e-coupon.

6. Grievance Redressal

Grievances regarding the processing of personal data under the Scheme may be addressed to:
a. Name: S M Krishnan
b. Designation: Company Secretary
c. Email: companysecretary@apollohospitals.com
d. Address: Secretarial Department, 3rd Floor, Ali Towers, 55 Greams Road, Chennai 600006.
Where a grievance is not resolved to the shareholder's satisfaction, the shareholder may approach the Data Protection Board of India in the manner prescribed under the DPDP Act, and the rules made thereunder.

7. Language

This Notice, and the consent obtained through the e-coupon portal for online registration, is provided in the English language only.