This notice covers the request-access form on this site. It does not cover the patient records a clinic keeps on the platform once it is set up; the clinic’s agreement with us covers those.
What we collect
When you send the form we collect:
- About your facility: its name, type, number of beds, specialties, city, state and PIN code, its establishment registration number and the state that issued it, and, if you give them, its GSTIN and ABDM Health Facility Registry ID.
- About you: your name, role, work email, mobile number and anything you write in the message.
- Your choices: the plan you are interested in, that you accepted this notice and when, which version of it you accepted, and whether you asked for product updates.
- A one-way code derived from your network address. We keep a keyed hash, never the address itself, to limit how many requests can be sent from one place.
The form must not contain patient information. Please don’t enter any.
Why we use it
To review your request, to check that your facility is real, to contact you about it, and, if it is approved, to set up your clinic with you as its first administrator.
We send you product updates only if you ticked the box asking for them. Write to us at any time to stop them.
Who sees it
Our onboarding team, who review requests by hand. We don’t sell your details or share them with advertisers. We check registration numbers by looking them up on public government websites ourselves; we don’t send your details to anyone to do it.
Where it is kept, and for how long
In India, in AWS’s Mumbai region.
- If your request is declined, withdrawn or expires, we delete your contact details, your message and your facility’s registration numbers 90 days later. We keep a stub with no personal details, to spot duplicate and abusive requests.
- If your request is approved, your details move into your clinic’s administrator account when the clinic is set up, and are removed from the request.
- The network-address code is deleted after 30 days in every case.
A request that is never confirmed by email expires after 24 hours. One that is confirmed but not decided expires after 30 days.
Your rights
Under the Digital Personal Data Protection Act, 2023, you can ask us what we hold about you, ask us to correct or erase it, and withdraw your consent. You can withdraw a request at any time from the link in the email we send when it reaches our team. For anything else, write to the address on our contact page. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.