Privacy Policy

1. "Anonymized Data": shall have the meaning assigned to it under the EULA.
2. "Data Protection Laws": means all applicable laws and regulations relating to the protection, privacy, or processing of personal data, including the Digital Personal Data Protection Act, 2023 and any rules, regulations, or amendments issued thereunder.
3. "Personal Data": has the meaning assigned to it under applicable Data Protection Laws, including the Digital Personal Data Protection Act, 2023.
4. "Patients" or "Customers": shall mean the individuals whose Personal Data, including any medical or health-related information, may be included in the Subscriber Data submitted or uploaded by the Subscriber to be Processed by the Software.
5. "Processing": means any activity performed on data, whether through manual or an automated process, including, recording, storage, organization, retrieval, adaptation, transmission, disclosure, anonymization, and deletion.
6. "Software": shall have the meaning assigned to it under the EULA.
7. "Subscriber": shall have the meaning assigned to it under the EULA.
8. "Subscriber Data": shall have the meaning assigned to it under the EULA, which may include audio and voice recordings submitted through the Platform.
9. "Usage Data": means data generated automatically by the Software including IP addresses, device identifiers, telemetry, log data, mobile device information, interaction with AI modules, error reports, and access timestamps.
10. "User": means any individual or entity authorized by the Subscriber to use or access the Software, including, without limitation, referring doctors, radiologists, technicians, administrators, transcription staff, call-center personnel or support staff.

Capitalized terms used but not defined in this Policy shall have the meanings assigned to them in the EULA or the SaaS Agreement. In the event of any inconsistency between this Policy and the EULA in relation to the processing of Personal Data, the provisions of this Policy shall prevail to the extent of such inconsistency.

This Policy explains how we handle Personal Data in connection with the services provided through the Platform. It also describes the type of information that may be Processed, the purposes for which such information may be used, and the safeguards implemented by us in relation to such Processing.

a. This Policy applies to:

• The Subscriber who accesses or uses the Software under a SaaS Agreement;
• The Users authorized by the Subscriber; and
• The Patients whose Personal Data forms a part of the Subscriber Data.

b. The Platform is intended for use by healthcare institutions, diagnostic centers, teleradiology providers, government healthcare bodies, health technology platforms, and authorized medical professionals. In the course of using the Platform, Subscribers or their Users may upload Subscriber Data, which may include medical imaging files, clinical information, or other data relating to Patients. Such information may contain Personal Data relating to identifiable individuals. In relation to such Subscriber Data, the Subscriber shall act as the Data Fiduciary, as defined under the Data Protection Laws, and the Company shall process such Personal Data as the Processor on behalf of the Subscriber.

c. The Platform may include additional functionalities such as speech-to-text, transcription tools, and a pregnancy calculator that assist healthcare professionals in reviewing and managing the Subscriber Data.

a. In connection with the use of the Software, we may collect or process the following:

i. Account Information

In order to enable access to the Software, we may Process certain information relating to the Subscriber and its Users. Such information may be provided during onboarding under the SaaS Agreement. This information may include the name of the organization, name and contact information of the Users, professional designations, and any other information required by us for authentication and administrative purposes.

ii. Subscriber Data

The Subscribers or their authorized Users may upload, submit, or otherwise provide Subscriber Data through the Software in the course of using the services. Where Subscriber Data contains any Personal Data, such information may be processed by us on behalf of the Subscriber for providing the Platform, generating Output Data, and delivering the services requested by the Subscriber under the applicable SaaS Agreement. The Subscriber shall ensure that it has obtained all informed, written, explicit or implicit consents as required under Data Protection Laws from the Customers.

iii. Usage Data

When the Software is accessed or used, certain technical and operational information may be generated automatically by the Platform. Usage Data may be processed by us for the purposes of maintaining and improving the Platform, monitoring the usage, security, troubleshooting and system diagnostics.

b. We do not independently collect any Personal Data from the Patients, and Process such information only when it forms part of the Subscriber Data.

a. Provision and Operation of the Platform

• We process certain information to enable Subscribers and Users to access and use the Software. This includes Processing information necessary to establish and administer user accounts, authenticate access to the Platform, manage user permissions and roles, and support the secure and reliable operation of the Platform. Access credentials for Users may be issued by the Company as part of the onboarding process and communicated through secure channels such as registered email addresses of the authorized administrators, one-time passwords (OTP), or activation links used for first-time login.
• Subscriber Data uploaded to the Platform may be processed for the purpose of delivering the services requested by the Subscriber. Such processing enables the Platform to analyze the Subscriber Data and generate Output Data, including AI reports, annotations, visualization findings, transcripts or other analytical results that are made available to the Users through the Platform. Such Processing is carried out solely to provide the services requested by the Subscriber and in connection with the applicable SaaS Agreement.

b. Maintenance and Improvement of Platform

• We may process certain information to maintain, support and improve the Platform. Usage Data may be analyzed to understand how the Platform is accessed and used by Subscribers and Users. Such analysis may assist us in improving existing features, enhancing system performance, and developing new functionalities intended to improve the overall user experience and operational efficiency of the Platform.

c. Security and Protection of Platform

• We may Process certain information to protect the security and integrity of the Platform. This may include monitoring usage and system activities, identifying suspected activities and taking appropriate steps to prevent any unauthorized access, misuse of the Platform, or any other activity that could affect the Platform.
• Such information may be reviewed from time to time as a part of internal security assessment practices or technical audits to ensure the Platform's operations are conducted securely.

d. Communication

• We may Process certain information to communicate with the Subscribers and Users regarding the Platform and the services. This may include responding to queries, providing technical assistance, and resolution of issues that arise during the use of the Platform.
• We may also use this information to communicate and send service-related information, such as service requests, downtime notifications, maintenance activities, security updates or any other changes affecting the operation of the Platform.

e. Legal Requests

• We may Process certain information to comply with Applicable Laws, regulatory obligations or lawful requests from the authorities having competent jurisdiction and authority.

f. Anonymized Data

• In the course of the provision of services, we may generate Anonymised Data derived from the Subscriber Data. Such data is Processed in a manner that it can no longer be used to identify an individual. Anonymized Data can be used by us for statistical analysis, system performance monitoring, Platform development, research, and improvement of the Platform, including to train and improve its AI models.

In the course of providing the services through the Platform, we may share or disclose information with third parties where such disclosure of information is necessary for the provision of services. Any such disclosure shall be as per this Policy and applicable Data Protection Laws.

a. Service Providers

We may engage third-party service providers to support the operations of the Platform, such as hosting and cloud service providers, storage, maintenance providers, and providers of technology services including natural language processing APIs, image processing APIs, OCR engines, and LLM providers. For speech-to-text transcription, audio voice recordings may be transmitted to Google LLC, which maintains data protection standards equivalent to or greater than those described in this Policy. These service providers assist us in the smooth operation of the Platform.

b. Legal Requirements

The Company may disclose information where such disclosure is necessary to comply with applicable laws, regulations, or lawful requests from courts, regulatory authorities, or other competent government bodies.

c. Business Transfer

If and when we undergo a business transaction such as a merger, acquisition by another company, corporate reorganization or sell a portion or the entirety of our assets to a third party, we shall reserve the right to transfer your data to such a new entity. The Processing of your information after the business transfer shall be in accordance with the privacy policy of such a new entity. If you do not wish to have your information processed in accordance with the terms of the emerging entities' privacy policy, you shall be entitled to exercise your rights provided thereunder.

a. Storage and Protection

• Information Processed through the Software is hosted and stored on a secure cloud infrastructure located in India. We do not transfer any Personal Data outside India.
• We maintain reasonable technical and organizational security measures designed to protect information processed through the Platform from unauthorized access, misuse, alteration, disclosure, or destruction.
• In the event we become aware of a security incident or data breach affecting information Processed through the Platform, we will take appropriate steps to investigate the incident, mitigate any potential impact, and comply with any notification obligations required under applicable Data Protection Laws.

b. Data Retention

• The Company retains information processed through the Platform only for as long as is necessary to fulfil the purposes described in this Policy, unless a longer retention period is required or permitted under Applicable Laws.
• Information relating to Subscriber and Users accounts may be retained for the duration of the Subscriber's use of the Platform and for a reasonable period thereafter in order to support account administration, resolve operational issues, comply with legal obligations, or enforce contractual rights.
• Subscriber Data is retained and Processed only to the extent necessary to provide the service through the Platform and generate Output Data requested by the Subscriber. The duration for which the Subscriber Data is retained as may be configured based on the Subscriber's preferences. Such Processing and retention is carried out in accordance with the instructions of the Subscriber and the terms of the applicable SaaS Agreement.
• We do not retain or use Subscriber Data for purposes other than providing the Platform, except where required to comply with Applicable Laws.

a. The individual whose Personal Data may be Processed through the Platform may have certain rights under the applicable Data Protection Law, such rights may include:

• Right to information: Data Principals may seek information regarding the Personal Data relating to them that is being Processed and the purposes for which such data is being used.
• Right to Access, Rectification and Erasure: Data Principals may request correction of inaccurate or incomplete Personal Data. They may also request erasure of such Personal Data.
• Right to withdraw consent: Data Principals shall have the right to withhold their consent for the Processing of your Data, or alternatively, if already provided, withdraw such consent. Such withdrawal will not affect the lawfulness of processing based on such previous consent.
• Right to Nominate: Data Principals may nominate another individual to exercise their rights under the Data Protection Laws in the event of death or incapacity.
• Right to raise grievance: Data Principals shall have the right to raise grievances on how we handle, process or store the Personal Data to our Grievance Officer in writing.

b. Where Personal Data relating to Patients forms a part of the Subscriber Data uploaded to the Platform, the Subscriber shall be responsible for handling the requests from such individuals in accordance with the Data Protection Laws.

c. We will, as requested by the Subscriber, provide all reasonable assistance and information to respond to such requests in accordance with the applicable Data Protection Laws.

a. To the extent that Subscriber Data Processed through the Software contains any information relating to individuals under the age of eighteen (18), the Subscribers or their Users shall be responsible for ensuring that the Processing of such information complies with the Data Protection Laws.

a. This Policy may be updated from time to time and shall be updated on our Platform. Subscribers may be notified of such updates through their registered email addresses or through notifications on the Platform.