Privacy Policy

Growman Research and Consulting Private Limited ("GRG Health", "Company", "We", "Our", "Us") is based out in India and recognizes the importance of maintaining the secrecy of its customer's, visitor's, client's, employees', research participant's ("Your", "You", "Yourself") personal data.

This privacy policy ("Privacy Policy") is made in compliance with the applicable Indian laws including Digital Personal Data Protection Act, 2023, Information Technology Act, 2000, and General Data Protection Regulations 2016 of the European Union. We process and control data relating to You which may be submitted by You on Our website, (www.grgonline.com) with any sub domain thereof, mobile/tablet/console applications or other present or future electronic modes ("Website") or via email, telephone, video conferencing or any other modes of communication while You avail Our services. We may also process personal data obtained from authorized third parties or publicly available sources, as well as information voluntarily provided by You, in accordance with applicable law. This Privacy Policy also sets out the rights available to You under applicable data protection laws in relation to such processing.

1. General

By using the Website, You agree that You have acceded to the terms of the present Privacy Policy. In the event that You do not wish to be bound by these terms, You have a choice, which is (naturally and obviously) to not access Our Website. This Privacy Policy also applies generally to our parent, affiliates, subsidiaries, or joint venture entities.

2. Consent

We request You to carefully read this Privacy Policy before sharing Personal Data (defined below) with us. We will process your Personal Data only on the basis permitted by law, including your consent, contractual necessity, legal obligations, or other lawful purposes. You may decline or withdraw consent at any time by contacting us; however, certain data may be essential for us to provide our services, and withdrawal of such consent may affect service availability. We may process your Personal Data without consent where such processing is permitted or required under applicable law, including compliance with legal obligations, safety or emergency situations, or for preventing or investigating offences.

You hereby acknowledge and agree to the collection, receipt, storage, use, processing, disclosure and transfer of Your Personal Data for the purposes set out in this Privacy Policy and in accordance with the provisions of this Privacy Policy. You represent that the Personal Data provided by You is accurate and complete, and that You shall not impersonate any other person while providing such data. The Company shall have no liability pertaining to the authenticity/genuineness/misrepresentation/fraud/negligence, etc. of the information disclosed nor will the Company in any way be responsible to verify any information obtained from You.

3. Personal Data Collected

With respect to Our services, We may require knowing some of Your Personal Data and non-Personal Data so that We can best meet Your needs. We collect Personal Data of Our employees, potential employees, clients, suppliers, business contacts, research participant, shareholders and Website users. If the data We collect are not listed in this Privacy Policy, We will give individuals (when required by law) appropriate notice of which other data will be collected and how it will be used and obtain specific consent for the use of such data whenever required.

When You access Our services, through the Website or via emails, telephone calls or other correspondence, We may ask You to voluntarily provide Us with certain information that personally identifies You or could be used to personally identify You. You hereby give Your consent to Us to access such information for providing You Our services pertaining to market research specifically in the health care space and market access insight on physicians, patient, general population, laboratory managers and directors, key government regulatory bodies, public and private payors (Insurance firms), hospital management, nurses and allied healthcare specialist, distributors and dealers of medical devices and pharmaceuticals etc. ("Services").

The information collected by Us from You may include (but is not limited to) the following personal data ("Personal Data"):

(a) Contact information (such as Your name, address, email address and phone number, etc.);

(b) Gender;

(c) Device and browser information;

(d) Log Data;

(e) Demographic Information;

(f) Date of Birth;

(g) Picture;

(h) Identity verification data (applicable only to registered members of Our verified community platform): professional credentials and licence details; government-issued identification; facial images and biometric data derived from liveness detection and identity/face-match verification; and device and email risk signals;

(i) Non-Personal Data: Information (viz. type of internet browser and operating system used, domain name of the website from which You came, number of visits, average time spent on the site, pages viewed etc.) may be picked up automatically and without explicitly being provided by You, but during Your interaction with the Our Website by the use of certain technologies, such as Cookies and Web Beacons.

Identity Verification and Biometric Data (Community Platform Members). Where You choose to register as a member of GRG Health's verified healthcare community platform, Your identity is verified through a multi-layer framework. This may include biometric liveness detection and a match between Your government-issued identification and Your facial image, performed at defined points including prior to the payment of any honorarium. Such biometric processing (a) applies only to platform members who complete registration, and not to other individuals whose data We process; (b) is carried out solely to confirm that You are a real, correctly identified healthcare professional and to prevent fraud and duplication; (c) is performed on the basis of Your explicit consent, captured within the registration and verification flow, which You may decline or withdraw (in which case verified membership may not be available); (d) may involve specialist identity-verification service providers acting on Our behalf under contractual confidentiality and data-protection obligations; and (e) is subject to defined retention limits, with biometric identifiers retained no longer than necessary for verification, fraud prevention and audit purposes and securely destroyed thereafter in accordance with Our data governance procedures.

4. Use of Personal Data

We collect and use Your Personal Data for the purposes of:

(a) Inviting You to participate in a research, confirming the details of research You have agreed to take part in and thereafter conducting the research with You;

(b) Conducting the research, and for validating answers/views that You have given in a recent research that we conducted, for quality assurance/verification purposes;

(c) Updating and ensuring that Our records of Your Personal Data are correct (applicable if You are part of an ongoing community/network/panel with GRG Health);

(d) Notifying You and for providing You with incentives/prize/gifts for taking part in a research;

(e) Discussing Your profile if You've applied for a position in Our organization;

(f) Processing and responding to Your queries and provide You with customer support;

(g) Sending You communications that You have requested or that may be of interest to You;

(h) Allowing You to participate in interactive features offered by Our Website;

(i) To send You promotional information about third parties which we think You may find interesting;

(j) Pursuing Our research objective, we use relevant data subjects'/research participant's Personal Data to connect with them to enquire about their interest in participating in Our research studies. So, the first connect is on the basis of 'legitimate interest' as per GDPR regulations related to processing. Here the respondents have a choice to refuse participation. Once the respondents agree to participate in the research, we proceed and take their consent in a more structured manner.

The information we collect can contain Your personal opinions, Personal Data and business contact information, where relevant to the research being undertaken. In addition, for online surveys we will record Your IP address, type of browser, OS You are using, Your screen size and other basic metrics.

We do not do any unnoticed processing of data from Your system. We will only collect and use Personal Data in accordance with this policy to the extent it constitutes legitimate use and is deemed reasonably necessary to serve Our legitimate business purposes, and we will maintain safeguards to ensure the security, integrity, accuracy and privacy of the information You have provided.

We make reasonable efforts to keep Personal Data in its possession or control, which is used on an ongoing basis, accurate, complete, current and relevant, based on the most recent information available to us. We rely on You to help us keep Your Personal Data accurate, complete and current by answering Our questions correctly.

We may transfer Your Personal Data to Our service providers, professional advisors, public and governmental authorities or third parties in connection with a (potential) corporate or commercial transaction. Such third parties may be located in other countries. Before We do so, We shall take the necessary steps to ensure that Your personal data will be given adequate protection as required by relevant data privacy laws and GRG Health's internal policies.

5. How We Use Your Personal Data

The Personal Data we collect is, in accordance with applicable data protection laws:

(a) Combined with the responses/views/opinions of others who participated in the same research and reported back anonymously to the client that commissioned the study;

(b) Used on an aggregated basis to analyse research result at various groups, segments or classification basis.

All of Your survey responses are treated as confidential. We will never intentionally disclose Your Personal Data or individual survey responses to the client that commissioned the study or any third parties unless:

(a) You request/agree/permit/consent/accord to share Your personally identifying information and individual responses. The details around what all Personal Data will be supplied to client or any third parties and how it will be used will be provided to you at the time we seek Your consent/approval.

(b) In the rare but possible circumstance that the information is subject to disclosure pursuant to judicial or other government subpoenas, warrants, orders or for similar legal, regulatory or contractual requirements.

Note: We never ask You to provide any confidential and material non-public information of Your business.

6. Who We Share the Data With

We do not sell Your Personal Data to third parties. From time to time we may employ other companies and individuals to perform functions on Our behalf. They may have access to the Personal Data needed to perform their functions, but will not use it for other than specified purposes. They must also agree to process the Personal Data as set out in this Privacy Policy.

Processing of prizes/incentives/gifts may result in Your contact details being passed onto a third party. This would purely be for the prize/incentive/gift to be sent out to you electronically or physically.

7. Choices About Use of Your Information

We believe it is important to give You choices about the use of Your information. We will use Your information as described in this Privacy Policy. If we want to use Your information for a purpose not described in this Privacy Policy, we will first get Your consent to do so, unless such processing is otherwise permitted or required under applicable law.

8. Controlling Your Personal Data

We will not sell, distribute or lease Your Personal Data to third parties unless we have Your permission/consent or are required by law to do so.

If You are EU data subject, You may request details of Personal Data which we hold about You under the Digital Personal Data Protection Act, 2023 / General Data Protection Regulation (GDPR) as applicable. If You would like a copy of the information held about You, please write Us to compliance@grgonline.com.

9. Data Security

We maintain organizational, physical and technical security arrangements for all the Personal Data we hold. We have protocols, controls and relevant policies, procedures and guidance to maintain these arrangements taking into account the risks associated with the categories of Personal Data and the processing We undertake.

10. Your Rights

You are entitled (in the circumstances and under the conditions, and subject to the exceptions, set out in applicable law) to:

(a) Request access to the Personal Data we process about You: this right entitles You to know whether we hold Personal Data about You and, if we do, to obtain information on and a copy of that Personal Data. To the extent that the processing of Your Personal Data is based on Your consent, You have the right to withdraw such consent at any time by contacting us.

(b) Request a rectification of Your Personal Data: this right entitles You to have Your Personal Data be corrected if it is inaccurate or incomplete.

(c) Object to the processing of Your Personal Data: this right entitles You to request that GRG Health no longer processes Your Personal Data.

(d) Request the erasure of Your Personal Data: this right entitles You to request the erasure of Your Personal Data, including where such Personal Data would no longer be necessary to achieve the purposes.

(e) Request the restriction of the processing of Your Personal Data: this right entitles You to request that GRG Health only processes Your Personal Data in limited circumstances, including with Your consent.

(f) Request to object to Our processing of Your Personal Data for direct marketing purposes including profiling. If You make such an objection, then we will cease to process Your Personal Data for this purpose.

(g) Request to object to Our processing of Your Personal Data for scientific or historical research purposes or statistical purposes on grounds relating to Your particular situation, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

(h) Request portability of Your Personal Data: this right entitles You to receive a copy (in a structured, commonly used and machine-readable format) of Personal Data that You have provided to Us and request Us to transmit such Personal Data to another data controller/data fiduciary.

You may exercise any of these rights by reaching out to us at details specified in Clause 24.2 of this Privacy Policy.

Grievance Officer. In accordance with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000, the designated Grievance Officer for GRG Health is: Akshat Bhatnagar, Chief Legal & Compliance Officer -- compliance@grgonline.com. You may contact the Grievance Officer for any grievance, query or request concerning Your Personal Data, including the exercise of Your rights under this Privacy Policy. Grievances will be acknowledged and responded to within the timelines prescribed under applicable law.

United States state privacy rights. Residents of certain U.S. states may have additional rights under applicable state privacy laws, including the right to know the categories of personal information We collect and the purposes of processing; the right to access, correct and delete personal information; and the right to opt out of the sale or sharing of personal information. GRG Health does not sell personal information, and does not share personal information for cross-context behavioural advertising. To exercise any of these rights, contact compliance@grgonline.com. We will not discriminate against You for exercising Your rights.

11. Access to Data

In all forms of marketing and opinion research, Your co-operation is voluntary at all times. We will be happy to review, update or remove information as appropriate and in compliance with applicable data protection laws, but please be aware that we may need to retain Your information on Our files to resolve disputes, enforce Our user agreement, or for technical and legal requirements and constraints related to the security, integrity and operation of Our online surveys as permitted or required under applicable law. We may require You to prove Your identity with approved identification before fulfilling Your request.

12. Retaining and Deleting Your Personal Data

We will retain Your Personal Data only for as long as is necessary. We maintain specific records management and retention policies and procedures, so that Personal Data are deleted after a reasonable time according to the following retention criteria:

(a) We retain Your data as long as We have an ongoing relationship with You.

(b) We will only keep the data while Your account is active or for as long as needed to provide services to You.

(c) We retain Your data for as long as needed in order to comply with Our global legal and regulatory obligations, or where retention is otherwise mandated or permitted under applicable law.

(d) We retain Your data for a longer period where such retention is necessary to comply with our contractual obligations, to the extent permissible under applicable law.

You can request to delete Your Personal Data by sending Your request at compliance@grgonline.com. Please note that We may retain Your information for compliance with a legal obligation to which We are subject, or in order to protect Your vital interests or the vital interests of another natural person.

13. Why is Market Research Important?

Market research is Your opportunity to give Your opinion on things that may affect You, Your business and Your family. Manufacturers, retailers, service companies, political parties and the Government can only succeed if they please You, the customer; so, they need to find out what You need and what You want. Your opinion can influence a wide range of products and services and have a bearing on issues that affect the quality of Your business or way of life. It is the job of market researchers to ask questions to find out what You think.

14. Reason for Contact Despite DND Registration

GRG Health does not sell or market any products to respondents. The purpose of our calls is always for genuine market research, the answers to which are completely confidential and only ever passed on to clients in an anonymised form.

15. Contacted Online

GRG Health takes every reasonable precaution to ensure the privacy and security of Your Personal Data while using the survey websites.

The roles of survey hosting tools (if any used by GRG Health) and/or of GRG Health are outlined below:

(a) Survey hosting tools operate the survey questionnaire software and data collection process that GRG Health employ to collect Your opinions online. The data from the survey will be held by such survey hosting tools in separate databases. Only GRG Health will receive the data collected online in the survey. At no time will the information You provide be used for any purpose other than research.

(b) It is not Our aim to sell or promote anything. These are marketing research surveys using scientific methods and we commit, in obtaining Your co-operation, we try Our best to provide You clear information about the nature of the research or how the findings will be used. Your responses will be treated as confidential unless You consent to being identified. In the relatively few instances where we ask permission/consent to pass on Your data in a way which would allow You to be personally identified, we will ensure that the information is only used for the stated purposes.

(c) We neither collect Personal Data nor encourage children to interact with the website. If we become aware that Personal Data relating to a child has been collected without verifiable consent, we will take reasonable steps to delete such data. If We become aware that a person submitting Personal Data is under the permissible age, we will delete the account and any related information from or about a User under the permissible age.

(d) We take every reasonable step to not process any Personal Data of a person with disability without obtaining prior consent of their lawful guardian or as per the applicable law of the country where research is conducted.

16. Remember

GRG Health conducts genuine market research, whether through emails, on the telephone, or online and such market research is:

(a) Confidential;

(b) Never used to sell You anything nor for requesting money;

(c) Never used to ask You to make an appointment with any salesperson.

17. Cross Border Transfer of Personal Data

Your Personal Data may be stored and processed in any country where We have facilities or in which We engage service providers, subject to such requirements or restrictions as may be specified by the Central Governments. In certain circumstances, courts, law enforcement agencies, regulatory agencies, or security authorities in those other countries may be entitled to access Your Personal Data. Further, while transferring data from European Economic Area to countries not considered adequate by the European Commission, We shall ensure to put in place adequate measures, such as standard contractual clauses adopted by the European Commission, to protect Your Personal Data.

18. Internet Protocol (IP) Address and Call Log

The calls made by You to Us with respect to the Services are recorded and maintained by Company. Company stores and maintains the IP address logs of all visitors who visit the Website. Company stores this information for providing efficient Services.

Your IP addresses are automatically tracked and collected by the Company and like most standard websites, We use log files to record the activity or events that occur between different users of a communication software. This data may include internet protocol (IP) addresses, date/time stamp, browser type, platform type, internet service provider (ISP), referring/exit pages, platform type, and number of clicks to analyse trends, administer the site, track Your movement in the aggregate, and gather broad demographic information for aggregate use. We do this to improve Our services We offer to You and to improve marketing, analytics or site functionality.

19. Amendment

We reserve the right to amend or modify this Privacy Policy at any time in accordance with applicable laws, as and when the need arises by giving prior notice to You, seeking your confirmation in respect of the same.

20. Opt-Out

In case You have provided us with Your e-mail or any other contact details after creating an account on Our Website or otherwise. We may send You notifications regarding certain promotions, or regarding the Services being availed by You, etc. However, in case You wish to stop receiving them We provide You with an option to opt-out of receiving non-essential (promotional, marketing-related) communications from Us on behalf of Our partners, and from us in general.

If You opt out, the Company may still send You non-promotional emails, such as emails about Your account.

21. Cookies

Our Website may store 'cookies' on Your computer server. A "cookie" is a small text file that may be used, for example, to collect information about the website activity. You can erase or choose to block these cookies from Your computer. Some cookies and other technologies may serve to recall Personal Data previously indicated by You. You can configure Your computer's browser to alert when We attempt to send You cookies and You can decide to whether or not to accept them and how to remove them. However, if You choose to remove cookies or reject cookies, this could affect certain features of the Website.

Other websites may place their own cookies or other files on Your computer, collect data or solicit Personal Data from You, for which We shall not be held responsible or liable. We encourage You to read the privacy policies of all external sites.

We use cookies and similar technologies for three purposes: to make the Website work, to understand how it is used through analytics services, and to show You relevant updates about our services on the professional networks and advertising platforms We use. Analytics and advertising cookies are set only after You accept them in the cookie notice shown on Your first visit, and You can change or withdraw that choice at any time through the same notice. Where such services are provided by third parties, they process the data as described in their own privacy policies.

22. Confidentiality and Security

We restrict access to Your Personal Data to Our and Our affiliates' employees, agents, third party service providers, partners, and agencies on a need to know basis who are involved in the process of assisting You while providing You the respective Services, and such persons shall be subject to adequate confidentiality obligations.

The security of Your Personal Data is important to Us. We have adopted high degree of reasonable security practices and procedures including password protection, encryption etc. to ensure that the Personal Data collected is protected and secured.

While We will endeavor to take all reasonable and appropriate steps to keep secure any information which We hold about You and prevent unauthorized access, You acknowledge that such steps are never 100% secure and that We cannot provide any absolute assurance regarding the security of Your Personal Data. To the fullest extent permissible by applicable law, We disclaim any liability in relation to any breach of security or unintended loss or disclosure of information in relation to Your Personal Data.

23. Correction of Personal Data

If You need to update or correct Your Personal Data, You may send corrections to Us at compliance@grgonline.com and We will take all reasonable steps to assist You and incorporate the changes within a reasonable period of time.

24. Contact Us

If you have any general questions about how GRG Health protects your Personal Data, please feel free to reach out to us at compliance@grgonline.com (Grievance Officer: Akshat Bhatnagar, Chief Legal & Compliance Officer) or at:

Growman Research and Consulting Pvt. Ltd.

SR No. 103, Office Nos. A1102 / A1103 / A1104,

Teerth Techno Space, Mumbai--Bangalore Highway,

Baner Gaon, Pune, Maharashtra 411045, India.

If you wish to exercise your rights relating to your Personal Data (as outlined in Clause 10), or otherwise contact us in our capacity as the data controller/data fiduciary, you may reach our Data Protection Officer at compliance@grgonline.com (preferred). You may also write to us by post, clearly addressed to "Data Protection Officer", at:

Growman Research and Consulting Pvt Ltd

SR No. 103, Office Nos. A1102 / A1103 / A1104,

Teerth Techno Space, Mumbai--Bangalore Highway,

Baner Gaon, Pune, Maharashtra 411045, India.