1. Who this policy covers
SoftHospitals is provided by Inovdigitech LLP, [Registered address – to be added] (“we”, “us”). The policy covers:
- hospitals and clinics that subscribe to SoftHospitals, and their staff who use it;
- patients whose records are kept by those hospitals in SoftHospitals, including patient app users;
- visitors to our website.
2. Hospitals are in charge of patient data
When a hospital records patient information in SoftHospitals, the hospital decides what is collected and why – it is the data fiduciary (data controller). We process that data on the hospital’s behalf and only on its instructions, to provide the service. Patients who want to see, correct or delete their records should contact their hospital first; we will help the hospital respond.
3. What data we handle
Hospital data (entered by the hospital)
- patient details such as name, age, gender, mobile number, address and ABHA number;
- health information such as visits, vitals, history, examinations, diagnoses, prescriptions, nursing notes, lab and imaging reports, operation notes, consent forms and discharge summaries;
- billing, payment, insurance / TPA and corporate credit records;
- pharmacy stock, purchase and supplier records, and finance records.
Staff accounts
- name, email address, mobile number, role and password (stored only as a secure hash);
- sign-in activity and an audit log of important changes made in the system.
Subscribing hospitals
- hospital name, contact person, address, phone, email and GSTIN;
- subscription and payment records. Card, UPI and bank details are entered on our payment partner’s secure page; we do not see or store full card numbers.
Website visitors
- basic technical information that web servers log automatically, such as IP address, browser type and the pages requested, used to keep the site running and secure.
- anything you choose to send us, for example by email.
4. Why we use it
- to provide the service to the hospital and its patients;
- to sign users in securely and show each user only what their role allows;
- to send messages the hospital asks us to send, such as prescriptions by WhatsApp or email, and one-time passwords (OTPs) for the patient app;
- to bill subscriptions and keep accounting records required by law;
- to provide support, fix problems, and protect the service against misuse;
- to meet legal obligations.
We do not sell personal data, and we do not use patient data for advertising or marketing.
5. Where and how it is stored
Every hospital has its own separate database. One hospital’s records are never stored together with another hospital’s, and each hospital is reached through its own subdomain.
We protect data with reasonable security practices, including:
- encrypted connections (HTTPS) between your browser and our servers;
- sign-in sessions kept in httpOnly cookies that scripts on the page cannot read;
- role-based access, login lockout after repeated wrong passwords, and an audit log;
- daily backups of every hospital database;
- access by our staff only when needed, under confidentiality obligations.
No system is perfectly secure. If a security incident affects personal data, we will inform the affected hospital without undue delay and help it meet its own obligations, including notifying authorities where required.
6. Who we share it with
We share data only with service providers who help us run SoftHospitals, such as:
- hosting and backup providers;
- our payment partner, for subscription payments;
- messaging providers (for example WhatsApp, email and SMS / OTP services), when the hospital uses them.
These providers may use the data only to provide their service to us. We may also disclose data when the law requires it, for example in response to a valid order from a court or government authority.
7. How long we keep it
- Hospital data is kept for as long as the hospital’s subscription is active.
- After a subscription ends, the hospital may ask for a copy of its data within 30 days. After that we may delete it, except records we must keep by law (for example, tax and invoice records).
- Backups are kept for a limited period and are then overwritten automatically.
- Hospitals are responsible for keeping medical records for the periods required by the rules that apply to them.
8. Your rights
Subject to applicable law, including the Digital Personal Data Protection Act, 2023, you may:
- ask for a summary of the personal data held about you;
- ask for incorrect data to be corrected or completed;
- ask for data to be erased when it is no longer needed and the law does not require it to be kept;
- withdraw consent you have given, where processing is based on consent;
- nominate someone to exercise these rights on your behalf;
- raise a grievance with us, and then with the Data Protection Board of India.
Patients should first contact their hospital. Staff and hospitals can contact us directly at support@softhospitals.com.
9. Cookies
We use only the cookies needed to keep you signed in. These are httpOnly session cookies, which scripts on the page cannot read. We do not use advertising or third-party tracking cookies. Your browser may also remember small settings on your own device to make the app work smoothly.
10. Children
Hospitals may record information about patients who are children, with the consent of a parent or guardian as required by law. Children should not create patient app accounts without a parent or guardian.
11. Changes to this policy
We may update this policy. The new version will be posted here with a new “last updated” date, and we will notify hospital administrators of important changes.
12. Contact and grievance officer
Grievance officer: [Grievance officer name – to be added]
Email: support@softhospitals.com
Address: [Registered address – to be added]
You can also reach us through our contact page.