Privacy Policy
This Privacy Policy explains how Good Samaritan Rehabilitation and Training Centre (GSRTC), operated under Samaritan Trust, collects, protects, uses, and handles your personal information across our website and digital services.
Policy Sections & Quick Navigation
Institutional Scope & Operating Entity
Good Samaritan Rehabilitation and Training Centre (GSRTC) is a charitable, residential rehabilitation centre located in Kannur, Kerala, India. GSRTC is an initiative established and operated by Samaritan Trust (Registered Charity No. 99/IV/17), governed by the CST Fathers of the St. Thomas Province, Kozhikode.
Our centre provides comprehensive residential care, multidisciplinary physical rehabilitation, neuro-rehabilitation, wheelchair mobility training, counseling, and vocational training to paraplegics, spinal cord injury survivors, stroke patients, and persons with disabilities. All rehabilitation services on campus are provided 100% free of charge to our beneficiaries.
This website (https://gsrtc.org and https://www.gsrtckerala.org) serves to inform the public about our rehabilitation programmes, facilitate voluntary donor support, handle general enquiries and admissions, coordinate volunteer engagement through OPPAM, and share inspirational stories of recovery.
Information We Collect & Collection Methods
We collect personal information directly and transparently when you interact with our website. We do not engage in covert surveillance, automated web harvesting, or silent third-party data tracking. The categories of information collected comprise:
General Enquiries & Admissions
When submitting our contact form at /contact, we collect:
- Full Name
- Email Address
- Contact Telephone Number
- Subject Category (e.g. Admission, General, Volunteering)
- Message Details
Donations & Section 80G Receipts
When you make a donation at /donate, statutory Indian tax laws require us to collect:
- Donor Full Name & Postal Address
- Phone Number & Email Address
- PAN or Aadhaar Number (Income Tax requirement)
- Donation Amount & Bank Transaction UTR
- Optional transfer receipt / screenshot
Volunteer & OPPAM Applications
When applying for voluntary service, student internships, or joining the OPPAM advisory network, we collect:
- Applicant Name, Institution, or Profession
- Contact Phone & Email
- Field of Expertise & Availability
- Statement of Interest or Motivation
Administrative Access Credentials
For authorized staff logging into the administrative portal (/admin):
- Administrative Username & Password hash (bcrypt)
- HTTP-only session tokens (gsrtc_admin_token)
- Administrative audit timestamps
Purposes for Which Information Is Processed
We process your personal information strictly for legitimate charitable, operational, and statutory purposes:
- Responding to Enquiries: Addressing questions regarding patient admission criteria, therapy regimens, residential accommodation, vocational training, or institutional partnerships.
- Statutory 80G Tax Compliance: Generating and issuing official donation receipts (Form 10BE) in accordance with Section 80G of the Indian Income Tax Act, 1961.
- Volunteer Coordination: Engaging community volunteers, social work interns, and multidisciplinary OPPAM advisory members.
- System Security & Audit: Protecting administrative portals from unauthorized access, credential stuffing, and cyber threats.
Google API Services & Google Drive User Data Policy Compliance
To provide full transparency and satisfy Google API verification and developer compliance requirements, this section provides explicit details on how the GSRTC website interacts with Google APIs.
Good Samaritan Rehabilitation and Training Centre's (GSRTC) use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Detailed Implementation & Scope Disclosures:
1. What Google Data Does GSRTC Access?
The GSRTC application requests strictly the scoped Google Drive permission: https://www.googleapis.com/auth/drive.file. Under this scope, the application only has access to files and folders created by the application itself or specifically shared with the application's administrative service account.
2. Do Website Visitors Log In with Google?
No. Website visitors, donors, students, and general public users do not sign in with Google. GSRTC does not access, read, collect, or store any personal Google account credentials, profile pictures, Gmail messages, contacts, or personal Google Drive files of website visitors.
3. Why Is Google Drive Used?
Google Drive is used exclusively as a backend, cloud-hosted asset storage repository by authorized GSRTC system administrators. Authorized administrators upload institutional photographs, rehabilitation video reels, press coverage clippings, and donor payment verification receipts directly into GSRTC's organizational Google Drive folder structure.
4. Prohibitions & Safeguards Under Google Limited Use
- No Third-Party Transfers: GSRTC does not transfer Google user data to third parties, unless necessary to comply with applicable law.
- No Advertising: GSRTC never uses or transfers Google user data to serve advertisements, personalized marketing, retargeting, or interest-based advertising.
- No AI Model Training: GSRTC never uses or transfers Google user data to build, train, or tune machine learning models or general artificial intelligence systems.
- No Human Inspection: No human is permitted to read raw Google user data except where required for security investigation, statutory compliance, or with explicit prior consent for storage troubleshooting.
- Credential Security: All Google OAuth tokens and service credentials are stored in encrypted server-side environment variables on secure cloud servers and are never transmitted to visitor web browsers or client-side bundles.
Donor Privacy & Section 80G Tax Exemption Compliance
All voluntary contributions made to Samaritan Trust – Good Samaritan Rehabilitation and Training Centre (GSRTC) are eligible for a 50% income tax deduction under Section 80G of the Income Tax Act, 1961 (Registration No. 99/IV/17).
Under circulars issued by the Central Board of Direct Taxes (CBDT), charitable organizations are legally mandated to upload donor details to the Income Tax Department portal to issue the official Form 10BE Certificate of Donation. Consequently:
- We collect donor PAN or Aadhaar and address solely for verifying donations and generating official 80G certificates.
- Financial contributions are completed directly through official trust bank accounts (South Indian Bank, Canara Bank), authorized UPI IDs, and direct bank transfers.
- No Card or Banking Passwords Stored: GSRTC does not process, store, or hold donor credit card numbers, debit card CVVs, net-banking passwords, or UPI PINs on our servers.
- Donor records are kept in secure, access-restricted database tables and retained for the minimum statutory period mandated by Indian tax and accounting authorities.
Beneficiary, Resident & Patient Privacy
As a humanitarian centre providing residential rehabilitation for persons with paraplegia, quadriplegia, mobility challenges, and neurological conditions, we uphold the utmost respect for personal dignity and human rights.
- Prior Informed Consent: All recovery stories, testimonials, photographs, and video features appearing on this website or in our media section are published strictly with the prior voluntary consent of the resident, survivor, or their legal guardians.
- Protection of Minors & Vulnerable Persons: We implement rigorous safeguarding measures. Identifiable details of minors or vulnerable individuals are never publicized without verified parental/guardian authorization.
- Right to Withdraw Consent: Beneficiaries or their legal representatives may withdraw consent for published media at any time. Upon receiving a withdrawal request, our team will promptly remove the associated photograph or story from our website and digital channels.
Data Storage, Technical Security & Retention
Storage & Encryption
Our digital infrastructure employs modern encryption and access control protocols:
- All network traffic is encrypted via HTTPS / TLS 1.3.
- Database records are stored in MongoDB Atlas with encryption at rest and in transit.
- No permanent uploads are written to local serverless filesystems.
- Administrative passwords are protected using industry-standard bcrypt hashing.
Retention Schedules
We retain personal records only as long as required by operational or statutory necessity:
- General Inquiries: Retained up to 12 months following resolution.
- Donor & Tax Records: Retained for 7 to 8 financial years as mandated by Indian tax and auditing laws.
- Beneficiary Media: Retained while relevant, or removed immediately upon revocation of consent.
Third-Party Services & External Integrations
To provide web hosting and communication, we engage trusted infrastructure providers subject to strict confidentiality:
- Vercel Inc.: High-performance serverless cloud hosting and global content distribution.
- MongoDB Atlas: Secure cloud database cluster provider for persistent data storage.
- Google Cloud & Google Drive: Administrative asset cloud storage conforming to Google's Limited Use policies.
- Google Maps Embed: Our contact page provides an embedded Google Map to assist visitors navigating to our centre in Kannur. Loading the map interacts directly with Google's servers in accordance with Google's standard privacy policies.
- WhatsApp Direct Connect: Our site includes an optional direct WhatsApp link to facilitate immediate communication. Engaging this link opens WhatsApp directly under Meta's privacy policies.
Your Rights Under Indian Data Protection Laws (DPDPA 2023)
Under the Digital Personal Data Protection Act, 2023 (DPDPA) and the Information Technology Act, 2000, you have well-defined rights regarding your personal data:
Right to Access
Request confirmation of whether we hold your personal data and obtain a summary of such data.
Right to Correction & Erasure
Request correction of inaccurate information or deletion of enquiry records when no longer necessary.
Right to Withdraw Consent
Withdraw your voluntary consent for communication or published media at any time.
Right to Grievance Redressal
Lodge a grievance with our designated Grievance Officer regarding any privacy concern.
Data Protection & Grievance Redressal Contact
If you have any questions, requests to exercise your data rights, feedback regarding this Privacy Policy, or concerns regarding Google API Limited Use compliance, please contact our official representative:
Good Samaritan Rehabilitation and Training Centre (GSRTC)
Under Samaritan Trust (Reg. No. 99/IV/17) • CST Fathers, St. Thomas Province