1.Who this policy covers
This policy applies to prospective students and their parents or guardians who use our website, forms, WhatsApp line or campus counselling desks; to enrolled students and parents who use the student and parent portals; and to visitors who simply browse the site. Where a student is under 18, we collect and process data only with the verifiable consent of a parent or lawful guardian, as the DPDP Act requires.
2.Data we collect
We collect only what is needed to answer your enquiry or run the programme:
- Enquiry and booking forms (callback, demo class, batch diagnostic, BOH registration, downloads, contact): name, mobile number, email, current class, target exam, preferred campus, course, your message, and the page you submitted from.
- Admission and enrolment: student and parent identity details, address, date of birth, school and board, mark sheets, photograph, medical fitness certificate for hostel residents, emergency contacts and fee-payment references.
- Portal usage: attendance, test scores, doubt-slot bookings, lecture views and hostel in/out logs.
- Technical data: IP address, browser type, device, referring page and campaign tags (UTM parameters) collected automatically when you visit.
- Communications: call notes, WhatsApp and SMS messages exchanged with our counsellors and wardens.
We do not knowingly collect sensitive personal data such as caste, religion, biometric templates or financial account numbers through the website. Biometric hostel entry, where used, is stored only on campus devices and never transmitted to the website.
3.Why we use your data (purposes and lawful basis)
- To respond to you — calling or messaging back about an enquiry, demo seat, diagnostic test or download you asked for (consent, and performance of the service you requested).
- To run the programme — timetables, tests, progress reports, hostel supervision, fee receipts, parent updates and refunds (performance of the enrolment contract).
- Safety and welfare — emergency contact, medical escalation and anti-ragging compliance (legitimate use for the safety of a minor, as permitted by the DPDP Act).
- Legal obligations — tax invoices, statutory records and responding to lawful requests from authorities.
- Improving the website — aggregated analytics on which pages and forms are used (consent, via the cookie banner where applicable).
- Marketing — admission updates, BOH test dates and scholarship news, only where you have opted in; you can opt out at any time by replying STOP or emailing us.
4.Consent and how to withdraw it
Every form on this site states, next to the submit button, what we will use your data for. Submitting the form is your consent for that purpose. For students under 18 we ask that the parent or guardian submits the form or confirms consent on the first counselling call.
You may withdraw consent at any time by emailing privacy@aspireiitmedical.com or messaging the helpdesk. Withdrawal does not affect processing already carried out, and we may still need to keep certain records to meet legal obligations (for example, fee receipts).
7.How long we keep data
- Enquiries that do not lead to enrolment: 24 months from the last contact, then deleted or anonymised.
- Enrolled students: for the duration of the programme and 8 years thereafter for academic records, fee receipts and statutory purposes.
- Hostel in/out logs and CCTV footage: 90 days unless needed for an incident investigation.
- Marketing consent records: until you withdraw consent, plus 3 years as proof of consent.
8.Your rights
Under the DPDP Act you (or a parent on behalf of a minor) may ask us to:
- Access a summary of the personal data we hold and how it has been used;
- Correct inaccurate or incomplete data, or update it;
- Erase data that is no longer necessary for the purpose it was collected, subject to legal retention;
- Withdraw consent for marketing or analytics;
- Nominate another person to exercise these rights on your behalf;
- Raise a grievance with our Grievance Officer and, if unresolved, with the Data Protection Board of India.
We respond within 30 days. To verify identity we may ask for the registered mobile number or an OTP.
9.Security
Data is stored on servers located in India with encryption in transit (TLS) and at rest, role-based access for staff, audit logs on portal access and annual security reviews. Counsellors can see only the enquiries assigned to their campus. In the unlikely event of a personal data breach we will notify affected individuals and the Data Protection Board as required by law.
10.Children and students under 18
Most of our students are minors. We do not run behavioural advertising aimed at children, do not track students across third-party apps, and restrict portal data to the student, their registered parent or guardian and the faculty responsible for them. Parents may review and request correction of a child’s record at any time through the parent portal or the Grievance Officer.
11.Grievance Officer
In line with the DPDP Act and the IT Rules, our Grievance Officer is:
Mr. Vikram Thakur, Registrar & Grievance Officer
Aspire IIT & Medical, Near BCS Chowk, New Shimla, Himachal Pradesh 171009
Email: privacy@aspireiitmedical.com · Phone: +91 98166 23676 (Mon–Sat, 10:00 AM – 5:00 PM)
We acknowledge every grievance within 48 hours and aim to resolve it within 30 days.
12.Changes to this policy
We review this policy at least once a year and whenever the law or our services change. Material changes are announced on this page and, for enrolled families, through the parent portal. The “last reviewed” date at the top tells you when it was last updated.