Who handles your information
Pinnacle Blooms Network is operated by Bharath Healthcare Laboratories Private Limited (BHCL). In these policies, “we”, “us” and “our” mean BHCL in its operation of Pinnacle Blooms Network.
This notice covers Pinnacle’s public website, enquiries and the information we handle to arrange and provide our services. An additional notice or consent form may apply to a particular assessment, programme, application, research activity or publication. We will explain that purpose before asking for the relevant information.
Information and purposes
- Contact and enquiry details: your name, contact number, location, preferred centre or service and the information you choose to provide, so our team can respond and discuss suitable arrangements.
- Service information: a child’s age, developmental or health history, assessment and care records, observations and relevant family or school information where necessary for the agreed service. Health and medical information receives sensitive-information treatment.
- Billing and transaction records: invoice, payment reference, amount and status needed to administer a transaction, accounts or a billing query. Do not email full payment credentials.
- Website information: technical, security and performance information and, with your optional analytics choice on managed pages, coarse page and action events. See our Cookie Policy.
- Publication and research information: any proposed identifiable story, image, recording or research use requires its own explanation and appropriate permission or other lawful basis; enrolment is not blanket permission to publish. A publicity choice cannot authorise publication prohibited by law; raw clinical records and sensitive health information must not be published.
We seek only information relevant to a stated, lawful purpose. A public enquiry is not a request to upload an entire clinical history. We obtain appropriate written consent before collecting sensitive personal information and explain when withholding information may prevent a particular service.
Children, guardians and consent
An adult parent, lawful guardian or authorised caregiver should make a child-related enquiry. We distinguish the adult’s contact details from the child’s service information. Before an assessment, recording, information exchange or other activity needs additional consent, the team must explain its purpose and obtain the appropriate permission. Public website browsing is not therapy consent.
We do not treat an adult’s disability as proof that the person lacks capacity or has a guardian. A representative’s authority must be established for the relevant decision. Children’s identifiable information must not be used in public marketing merely because their family enrolled.
Access, sharing and external providers
Relevant authorised personnel may use information for the agreed enquiry, care, administration or support purpose. Service providers may process the information necessary for hosting, communications, authorised measurement, payments or other specified tasks. Information may also be disclosed when law requires it.
A school, teacher or other care provider should receive identifiable child information only with appropriate permission or another applicable lawful basis. Transfers of sensitive information must meet applicable protection and consent or contractual requirements. This notice does not claim that every system is hosted only in India. See our Third-Party Integration Policy.
Retention and safeguards
Retention depends on the service purpose, care and continuity needs, accounting and statutory duties, consent, disputes and applicable record requirements. We do not retain information indefinitely merely because it was collected. You may ask which criteria apply to your record; an erasure request is assessed against lawful retention duties.
We require confidentiality, appropriate access restrictions and reasonable security safeguards for the information handled. No website notice promises absolute security. Report a suspected disclosure or security concern through the contact below; avoid sending the affected child’s records to public social-media channels.
Your choices and privacy requests
You may ask to review or correct information, withdraw consent for a consent-based purpose, or request deletion where applicable. Optional publication or marketing permission can be declined without turning it into consent for care. Withdrawal does not automatically erase records lawfully required to be retained or undo processing already lawfully completed.
Email care@pinnacleblooms.org with the subject “Privacy request — Grievance Officer”, a way to contact you and the information needed to understand your request. You can call 9100 181 181 for guidance. Do not send passwords, OTPs, full card details or unnecessary child records.
Privacy Grievance Officer: Mr. Gokul Krishna Rao, Bharath Healthcare Laboratories Private Limited. Contact: care@pinnacleblooms.org · 9100 181 181. Tell us the request and relevant relationship to the record. We may request proportionate identity or authority information before disclosing or changing a child’s record. Retain your sent email for reference. Privacy/SPDI grievances are to be addressed expeditiously and within one month of receipt under the currently applicable SPDI Rules.
DPDP transition as at 1 October 2026
The Digital Personal Data Protection Act, 2023 and Rules, 2025 have phased commencement. Institutional provisions are in force; consent-manager provisions are scheduled for November 2026, and the main notice, consent, safeguards, children’s-data and individual-rights provisions are scheduled for May 2027. We are preparing for those phased requirements. This notice does not claim that all provisions already apply or that publication establishes completed compliance.
The future children’s-data framework includes verifiable parental or lawful-guardian consent and restrictions on detrimental processing, targeted advertising and behavioural tracking. Limited healthcare-related exceptions are purpose-specific; we do not claim a blanket exemption. The current SPDI grievance timeframe is not replaced by the future DPDP grievance ceiling.
Updates and related notices
This edition is effective from 1 October 2026. It replaces the previous public website wording for this subject. Material changes will be dated here. It does not retrospectively introduce charges or remove rights under an existing agreement.
Nothing in this policy removes a right, remedy, complaint route or protection that applicable law gives you. Booking-specific written terms must be disclosed before you agree; they cannot override mandatory law.
Cookies and controls · Children and guardians · Stories and publication