How RISA protects your personal data.

01Who we are

RISA Smart Ambulance (“RISA”, “we”, “us”) runs a connected ambulance network that links patients and families with verified ambulances, trained crews and partner hospitals in Ahmedabad, Gandhinagar and Gurgaon. We have been operating since 2019.

For the personal data we process to provide our services, RISA is the Data Fiduciary under the Digital Personal Data Protection Act 2023 (the “DPDP Act”) and the Digital Personal Data Protection Rules 2025 (the “DPDP Rules”).

Office: 307, Satyam 1, Amba Business Park, behind Trimandir, Adalaj, Gujarat 382421. Email: contact@smartambulance.com.

02What this notice covers

This notice applies when you call the RISA helpline on 1800 108 1800, use this website, request or ride in a RISA ambulance, or work with us as a partner hospital or fleet. It explains what we collect, why, who sees it, how long we keep it and the rights you have.

Once a patient is handed over, the receiving hospital keeps its own records under its own privacy notice. RISA is not responsible for how a hospital processes data after handover.

03Personal data we collect

We collect only what we need to send the right ambulance, care for the patient on the way and complete the trip.

04Why we use it

• To answer your call and send an ambulance with the right level of care.
• To care for the patient during the trip and prepare the receiving hospital before arrival.
• To hand over the patient with a complete record of the trip.
• To prepare invoices, take payment and support insurance claims you ask us to help with.
• To verify ambulances, drivers and crews against the RISA Standard.
• To review the safety and quality of our service, including through call recordings.
• To answer questions, requests and grievances.
• To meet our duties under Indian law, including orders of courts and authorities.
• To improve our service using information that no longer identifies anyone.

05Our legal basis

We process personal data either with your consent or for a legitimate use allowed by Section 7 of the DPDP Act.

• Consent. When we ask for consent, we give a clear notice in plain language. You can withdraw consent at any time, as easily as you gave it. Withdrawal does not affect processing done before it.
• Medical emergency. The DPDP Act allows processing to respond to a medical emergency involving a threat to life or an immediate threat to health. In an emergency we act first and give you notice as soon as the situation allows.
• Legal duty. We process data when the law, a court or a government authority requires it.

06Children and people who need a guardian

If the patient is a child under 18, or a person with a disability who has a lawful guardian, we seek verifiable consent from the parent or lawful guardian, as Section 9 of the DPDP Act and the DPDP Rules require.

In a medical emergency we will not delay care to obtain consent. We never track children for advertising or target advertising at them.

07Who we share it with

We share personal data only with those who need it to deliver or support the service.

• The receiving hospital, so its team is ready when the patient arrives.
• The assigned fleet and crew, so they can reach and care for the patient.
• Service providers who process data for us under contract, such as cloud hosting, telephony and SMS, mapping and payment providers. They may use the data only on our instructions.
• Insurers and third party administrators, only when you ask us to or give consent.
• Government authorities, when the law requires it.

08Where your data is kept

Personal data is stored in India on secure cloud infrastructure. If any data is ever processed outside India, we will do so only as permitted by the Central Government under Section 16 of the DPDP Act.

09How long we keep it

We keep personal data only as long as the purpose needs it, or longer if the law requires. After that it is erased or made anonymous.

10How we protect it

We use reasonable security safeguards suited to health data, including encryption in transit and at rest, access based on role, strong sign in for staff, monitoring and audit logs of who saw what, contracts with every service provider and regular staff training.

Read more on our Security and Privacy page.

11If a breach happens

If a personal data breach affects you, we will tell you without delay, in plain language, what happened, what it may mean for you and what we are doing about it.

We will also inform the Data Protection Board of India and send it a detailed report within 72 hours of becoming aware of the breach, as the DPDP Rules require.

12Your rights

Under the DPDP Act you have the right to:

• Access a summary of your personal data and the people we have shared it with.
• Correct, complete and update data that is wrong or out of date.
• Erase data we no longer need, unless the law requires us to keep it.
• Withdraw consent at any time.
• Raise a grievance and have it answered.
• Nominate another person to use these rights if you die or are unable to.

To use a right, write to contact@smartambulance.com with the subject “Data request”, or use the form on the Grievance Officer page. We will verify your identity and reply within the period set by law, and in any case within 90 days.

You also have duties under Section 15 of the DPDP Act: to give accurate information and not to file false or frivolous complaints.

13Cookies on this website

This website uses only the cookies it needs to work. If we add analytics or other optional cookies, we will ask for your consent first. You can clear or block cookies in your browser settings.

14Grievances and the Data Protection Board

If you have a concern about how we handle your personal data, please contact our Grievance Officer first. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

15Changes to this notice

We will update this notice when our practices or the law change. The date at the top shows when it was last updated. If a change is significant, we will tell you before it takes effect.

The DPDP Rules were notified in November 2025 and come into force in phases. RISA is aligning its practices ahead of each date.