2.1 Information You Provide Directly

• Account Information: Hospital name, administrator details, contact information, billing details
• User Information: Names, email addresses, phone numbers, job titles, roles and permissions
• Patient Information: Medical records, personal details, insurance information, treatment history
• Communication Data: Support requests, feedback, correspondence with our team

2.2 Information Collected Automatically

• Usage Data: Log files, access times, pages viewed, features used
• Device Information: IP addresses, browser type, operating system, device identifiers
• Performance Data: System response times, error logs, usage patterns

3.1 Service Provision

• Providing and maintaining our hospital management system
• Processing transactions and managing billing
• Facilitating communication between healthcare providers and patients
• Generating reports and analytics for hospital operations

3.2 Service Improvement

• Analyzing usage patterns to improve user experience
• Developing new features and functionality
• Conducting research to enhance healthcare delivery
• Optimizing system performance and reliability

3.3 Legal and Security

• Complying with legal obligations and regulations
• Protecting against fraud, abuse, and security threats
• Enforcing our terms of service and policies
• Responding to legal requests and court orders

4.1 With Your Consent

We may share information when you have given us explicit consent to do so.

4.2 Service Providers

We may share information with trusted third-party service providers who assist us in:

• Cloud hosting and data storage
• Payment processing
• Email and communication services
• Technical support and maintenance

All service providers are bound by strict confidentiality agreements and data protection requirements.

4.3 Legal Requirements

We may disclose information when required by law, court order, or government regulation, or when necessary to:

• Comply with legal processes
• Protect our rights and property
• Ensure user safety and security
• Investigate potential violations of our terms

5.1 Technical Safeguards

• Encryption: 256-bit SSL/TLS encryption for data in transit
• Data at Rest: AES-256 encryption for stored data
• Access Controls: Multi-factor authentication and role-based access
• Network Security: Firewalls, intrusion detection, and monitoring
• Regular Updates: Security patches and software updates

5.2 Physical Safeguards

• Secure data centers with 24/7 monitoring
• Biometric access controls and security cameras
• Environmental controls and backup power systems
• Secure disposal of hardware and storage media

5.3 Administrative Safeguards

• Employee background checks and security training
• Confidentiality agreements and access limitations
• Regular security audits and vulnerability assessments
• Incident response and breach notification procedures

6.1 HIPAA Compliance

For US-based healthcare providers, we act as a Business Associate under HIPAA and:

• Execute Business Associate Agreements (BAAs) with covered entities
• Implement required safeguards for Protected Health Information (PHI)
• Provide breach notification as required by law
• Allow patients to exercise their rights under HIPAA

6.2 International Compliance

We comply with applicable healthcare privacy laws in all jurisdictions where we operate, including:

• Personal Data Protection Act (PDPA) in various countries
• General Data Protection Regulation (GDPR) for EU data subjects
• Local healthcare privacy regulations

6.3 Patient Rights

Patients have the right to:

• Access their health information
• Request corrections to inaccurate data
• Receive an accounting of disclosures
• Request restrictions on use and disclosure
• File complaints about privacy practices

7.1 Types of Cookies

• Essential Cookies: Required for basic functionality and security
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Help us understand usage patterns and improve our service
• Security Cookies: Protect against fraudulent activity and unauthorized access

7.2 Cookie Management

You can control cookies through your browser settings. However, disabling certain cookies may affect the functionality of our software.

8.1 Retention Periods

• Account Data: Duration of subscription plus 7 years for legal compliance
• Patient Records: As required by applicable healthcare laws (typically 7-10 years)
• Financial Records: 7 years for tax and legal purposes
• System Logs: 90 days (security logs retained for 1 year)
• Communication Records: 3 years for support and service improvement

8.2 Data Deletion

When data is no longer needed, we securely delete it using industry-standard methods that make recovery impossible.

9.1 Access and Portability

• Request access to your personal information
• Receive a copy of your data in a portable format
• Export your data when terminating service

9.2 Correction and Deletion

• Correct inaccurate or incomplete information
• Request deletion of personal information (subject to legal requirements)
• Update your account and profile information

9.3 Processing Restrictions

• Object to certain types of processing
• Restrict processing in specific circumstances
• Withdraw consent where processing is based on consent

10.1 Transfer Safeguards

• Standard Contractual Clauses for EU data transfers
• Adequacy decisions where available
• Binding Corporate Rules for internal transfers
• Additional safeguards as required by local law

10.2 Data Localization

Where required by law, we ensure data remains within specific geographic boundaries and comply with local data residency requirements.

11.1 Pediatric Patient Data

When processing health information for pediatric patients, we:

• Follow applicable laws regarding minors' health information
• Respect parental rights and guardian consent requirements
• Provide appropriate protections for sensitive information

12.1 Notification of Changes

• Email notification for material changes
• In-app notifications for significant updates
• Posted updates on our website
• 30-day advance notice for major changes

12.2 Continued Use

Your continued use of our services after changes take effect constitutes acceptance of the updated Privacy Policy.

Privacy Officer

• Email: privacy@sanvyahealth.com
• Phone: +91 7086178512
• Address: Sanvya Health Software, India

Data Protection Officer (EU)

For EU-related privacy matters, contact our Data Protection Officer at dpo@sanvyahealth.com