Privacy Policy

For patient data, your clinic is the data fiduciary and [YOUR COMPANY LEGAL NAME] is a data processor acting on your instructions, in line with India's Digital Personal Data Protection Act, 2023.

For your own account details (name, email, billing contact) we are the data fiduciary.

Workspace data you enter: patient demographics, clinical notes, prescriptions, appointments, inventory, invoices, payments, staff records and the audit trail of who changed what.

Account data: your name, email, authentication credentials (hashed), and the workspace you belong to.

Technical data: request logs and error reports needed to keep the service secure and reliable. We do not use advertising trackers.

Data is stored with our infrastructure provider in the region configured for your workspace, encrypted in transit (TLS) and at rest. Backups are taken automatically.

Every record carries a workspace identifier and every request is checked against the caller's membership and role before any data is returned. Access by our staff is limited to named platform administrators, requires a business reason, and is itself logged.

Your staff, according to the roles you assign. Our infrastructure providers, as processors under contract. No one else — we do not sell or share data with advertisers, and we disclose to authorities only when legally compelled, notifying you where permitted.

Data is retained while your workspace is active. After termination it stays available for export for 30 days and is then deleted. Audit logs may be kept longer where a law requires it.

Patients may exercise their rights (access, correction, erasure) through your clinic; we provide the tools to fulfil those requests.

You can export data as CSV at any time, deactivate staff instantly, and close the workspace by contacting us. Questions or complaints: [privacy@yourcompany.in]. Grievance officer: [name, contact].

We announce material changes to this policy inside the product at least 30 days before they take effect.