Privacy Policy

1. Who is responsible

test clinic ("Hospital") decides why and how patients' personal data is used, and is the "data fiduciary" under India's Digital Personal Data Protection Act, 2023. the Software Provider ("Provider") licenses the software and, only when the Hospital asks for support, may act as a "data processor" on the Hospital's instructions.

2. What is recorded

Patient details (name, mobile, date of birth, address, photo, ABHA ID), appointments, vitals, symptoms, diagnosis, prescriptions, lab requests and results, vaccination records, certificates, bills and payments, IPD admissions, and attached files.

Staff details (name, email, role) and a log of who did what in the software (audit log), including sign-ins.

3. Why it is used

Only to provide healthcare and run the Hospital: treating the patient, keeping medical and billing records, reminders for appointments and vaccinations, reports for the Hospital, and keeping the system secure. Data is not sold and is not used for advertising.

4. Where it is stored

On the Hospital's own installation, in its own database, separate from every other hospital using the software. Nightly backups are kept on the same server and, if the Hospital sets it up, in an off-site location the Hospital chooses.

5. Who can see it

Only the Hospital's own signed-in staff, according to their role (doctor, nurse, reception, pharmacy, lab, accounts, admin). The Provider can see data only while giving support the Hospital has asked for.

A patient may be sent a private link to view their own prescription history (for example on WhatsApp). Anyone who holds that link can open it, so patients should not share it.

6. How long it is kept

Medical records are kept for as long as the Hospital needs them for care and as the law requires. The Hospital can delete a record, and can export all data, from within the software.

7. Patients' rights

Patients may ask the Hospital to see their information, correct it, or erase it where the law allows, and may withdraw consent for uses that depend on it. Requests go to the Hospital, which can act on them inside the software.

8. Security

Access needs a personal login with a strong password; repeated wrong passwords temporarily block sign-in; actions are recorded in an audit log; connections should use HTTPS. The Hospital must also keep its devices, network and passwords secure.

If personal data is ever exposed, the Hospital will be informed without delay so it can meet its own duty to notify.

9. Contact

Questions about a patient's own records go to test clinic.