Privacy policy
Last updated: 31st October, 2026
1. Who we are and what this policy covers
YES Health is a brand of YellowStone Healthcare Services Private Limited ("YES Health", "we", "us"), a company registered in India (CIN: U87300MH2026PTC474683) with its registered office at Mumbai, Maharashtra. We provide doctor-led healthcare at home, including nursing and attendant care, doctor consultations, procedures, medical equipment and related services.
This policy explains what personal data we collect, why we collect it, who we share it with, how we protect it, and the rights you have. It applies when you:
- use our website www.yeshealth.in or contact us by WhatsApp, phone (+91 84240 71512) or email (care@yeshealth.in)
- ask for or receive care from us, for yourself or for a family member
- refer a patient to us as a doctor or hospital
- apply to work with us, or partner with us as a nurse, attendant, bureau, equipment supplier, pharmacy or lab
Under the DPDP Act, we are the Data Fiduciary, the organisation that decides how and why your data is used. You are the Data Principal, the person the data is about.
Your consent. We ask for your consent before collecting your personal data, and we tell you what it is for. You can withdraw consent at any time, as easily as you gave it (see section 7). If you share someone else's data with us, such as a parent's health details, please make sure you have their permission or are legally allowed to act for them.
2. Personal data we collect
We collect only what we need to arrange and provide care, and to run our business.
| Type of data | Examples | Whose data |
|---|---|---|
| Contact details | Name, mobile or WhatsApp number, email, home address, preferred language | Patients, family members, referrers, partners |
| Health information | Medical history, diagnosis, prescriptions, test and scan reports, discharge summaries, vital signs, care notes, allergies, mobility and diet needs | Patients |
| Identity details | Age, gender, ID proof where required for a procedure, equipment rental or insurance | Patients, partners |
| Care and visit records | Care plans, visit times, staff assigned, daily updates sent to family, photos of wounds or equipment taken only with consent for clinical use | Patients |
| Payment details | Invoices, payment method, UPI or bank reference, insurance or corporate billing details. We do not store full card numbers. | Patients, family members |
| Professional details | Qualifications, registration numbers, work history, references, background checks | Doctors, nurses, attendants, bureaus, job applicants |
| Communications | Messages, call notes, form entries, feedback and complaints | Everyone who contacts us |
| Website data | IP address, device and browser type, pages visited, cookies (see section 8) | Website visitors |
Health information is sensitive. We treat it with extra care, limit who can see it, and use it only to provide and improve your care.
3. How we collect it
- From you: When you fill in a form on our website, call or WhatsApp us, or share documents with our team.
- From family members or caretakers who contact us on behalf of a patient.
- From doctors and hospitals who refer a patient to us, such as discharge summaries and treatment advice.
- During care: our doctors, nurses and attendants record observations and care notes at each visit.
- From partners we work with, such as labs and pharmacies, when they return test results or confirm orders.
- Automatically, through cookies and similar tools when you use our website.
4. Why we use your data
We use your personal data only for the purposes below, and we will ask again before using it for anything new.
- To respond to you: call you back, answer questions and understand what care is needed.
- To plan and provide care: have our doctor assess the patient, prepare a care plan, assign staff, arrange equipment, tests and medicines, and keep accurate clinical records.
- To keep the family informed: send daily updates by WhatsApp to the family members the patient or their guardian names.
- To coordinate with the treating doctor or hospital, with the patient's consent.
- To bill and collect payment, including insurance or corporate billing where you ask us to.
- To keep patients and staff safe: verify staff identity and qualifications, and investigate incidents or complaints.
- To improve our services: review feedback, quality of care and how our website is used. Where possible we use data that no longer identifies you.
- To meet the law: keep records that healthcare and tax laws require, and respond to lawful requests from courts or authorities.
- To send you updates about our services, only if you agree. You can opt out at any time by replying STOP on WhatsApp or emailing us.
The law also allows us to use personal data without fresh consent in a medical emergency involving a threat to life or health. We will tell you as soon as we reasonably can if we do this.
We do not sell your personal data, and we never use health information for advertising.
5. Who we share it with
We share personal data only when it is needed for your care or required by law, and only the part that is needed.
| Who | What they receive | Why |
|---|---|---|
| Our doctors, nurses and attendants, including partner staff and bureaus we engage | Patient details, care plan and relevant health information | To provide care at home |
| The patient's treating doctor or hospital | Care updates and reports | To keep care consistent, with the patient's consent |
| Labs, pharmacies and equipment suppliers | Name, address, contact number and the test, prescription or equipment needed | To deliver the service you asked for |
| Family members the patient names | Daily updates and care information | To keep the family informed |
| Service providers who work for us, such as WhatsApp Business, Google Workspace, website hosting, billing and payment providers, and Google and Meta for advertising (website data only, with your cookie consent) | Only the data needed for their task | To run our operations |
| Insurers or your employer | Billing and treatment details | Only when you ask us to bill them |
| Courts, police or government authorities | What the law requires | To meet a legal obligation |
Everyone who processes data for us must sign a written agreement to keep it confidential and secure, and to use it only on our instructions. If our business is merged or sold, your data may transfer to the new owner, who must continue to protect it under this policy.
6. How we protect and store your data
Security. We use reasonable security practices, including:
- access limited to staff who need it for your care, with individual logins
- encryption of data in transit and, where available, at rest
- secure, business-grade tools for email, storage and messaging
- confidentiality agreements and privacy training for all staff and partners
- monitoring of access logs, kept for at least one year, to detect misuse
No system is completely secure. If a data breach affects you, we will inform you without delay, tell you what happened and what you can do, and report it to the Data Protection Board of India as the law requires.
How long we keep it. We keep personal data only as long as needed for the purpose it was collected for, or as long as the law requires:
| Data | How long we keep it |
|---|---|
| Medical and care records | 5 years after the last episode of care, or longer if a law or dispute requires |
| Billing and tax records | 10 years, as required by tax and company law |
| Enquiries that did not lead to care | 24 months |
| Job and partner applications not taken forward | 24 months |
| Website logs | At least 1 year |
After that, we delete the data or remove anything that identifies you.
Where it is stored. We store data in India where possible. Some service providers, such as cloud email and messaging tools, may store data outside India. We transfer data abroad only to countries the Government of India permits and only to providers who protect it to the standard required by Indian law.
7. Your rights
You have the right to:
- Know what personal data we hold about you and who we have shared it with
- Correct or update data that is wrong, incomplete or out of date
- Ask us to erase your data when it is no longer needed. We may keep records the law requires us to keep, and will tell you if so.
- Withdraw consent at any time. This does not affect anything we did before you withdrew it. If you withdraw consent for care-related processing, we may no longer be able to provide care.
- Nominate someone to exercise these rights for you if you die or become unable to act
- Raise a grievance with us, and then with the Data Protection Board of India if you are not satisfied
To use any of these rights, contact our Grievance Officer (section 9). We may ask you to confirm your identity. We will respond as soon as possible, and within 90 days at the latest.
Patients who cannot consent for themselves. For a child under 18, or an adult who cannot make decisions because of illness or disability, we ask for consent from a parent or lawful guardian. We may check their identity or authority before relying on that consent.
8. Cookies, WhatsApp and other websites
Cookies. Our website uses a small number of cookies to make it work and to understand how many people visit. We also use advertising and analytics tools from Google and Meta. Their cookies help us measure how our ads perform and show our ads to people who have visited our website. These tools never receive health information or anything you type into our forms. We ask for your consent, through a cookie banner, before setting these cookies, and you can change your choice at any time. You can block or delete cookies in your browser settings. Some parts of the site may then not work as expected.
WhatsApp. We use WhatsApp Business to talk to families and send care updates. Messages pass through WhatsApp, which is run by Meta under its own privacy policy. Tell us if you prefer updates by phone or email instead.
Other websites. Our website may link to other sites. We are not responsible for how they handle your data, so please read their privacy policies.
9. Changes and contact
Changes to this policy. We may update this policy when our services or the law change. We will post the new version on this page with a new date and, for significant changes, tell you directly.
Grievance Officer. If you have a question or complaint about your personal data, contact:
Siddharth, Grievance Officer
YellowStone Healthcare Services Private Limited
Lower Parel, Mumbai, Maharashtra
Email: care@yeshealth.in
WhatsApp / Phone: +91 84240 71512
If you are not satisfied with our response, you may complain to the Data Protection Board of India.